Global Security Incident Response Lead (AI-Driven)

JD.com Inc.; Greater London; On-site; GBP 90,000 - 140,000; Full time

Job summary

JD.com is seeking a security incident response leader to drive high-impact investigations in a 24/7 global on-call model, focusing on defense, detection and response capabilities. You will own the full incident lifecycle from detection to containment and recovery, working cross-functionally to strengthen Joybuy’s security posture.

This role emphasizes automation and AI-driven workflows to improve triage and investigations, and requires DFIR expertise and a passion for scalable detection.

Qualifications

• Strong experience in security incident response and investigations in cloud-first environments.
• Hands-on experience with SIEM, EDR, and/or detection engineering.
• Experience with cloud platforms (AWS & GCP).
• Familiarity with threat intelligence and adversary tactics (e.g., MITRE ATT&CK).
• Experience building or working with automation (e.g., Python, scripting, SOAR).
• Ability to operate effectively during high-severity incidents.
• Excellent written communication skills with a passion for clear, actionable documentation.
• Growth mindset with a proactive approach to identifying and mitigating security risks.

Responsibilities

• Lead and coordinate end-to-end incident response for high-severity security events within a 24/7 global on‑call model, with this role operating during EMEA business hours
• Prepare clear executive communications that keep stakeholders informed during incidents
• Investigate complex security incidents across cloud environments, applying strong DFIR methodologies
• Build and enhance automation and AI-assisted workflows to improve triage, investigation speed, and response consistency
• Partner with Threat Intelligence to contextualize threats and improve detection coverage
• Conduct root cause analysis (RCA) and lead post‑incident reviews to drive continuous improvement and risk reduction
• Develop and maintain runbooks, playbooks, and operational documentation
• Mentor other engineers and help elevate the team’s overall incident response maturity

Skills

Incident response

SIEM/EDR

Cloud platforms

Threat intelligence

Automation tooling

Executive communication

High-severity handling

Documentation skills

Tools

Python

SOAR platforms

Scripting

Job description

JD.com is seeking a security incident response leader to drive high-impact investigations in a 24/7 global on-call model, focusing on defense, detection and response capabilities. You will own the full incident lifecycle from detection to containment and recovery, working cross-functionally to strengthen Joybuy’s security posture.

This role emphasizes automation and AI-driven workflows to improve triage and investigations, and requires DFIR expertise and a passion for scalable detection.