Incident Manager - SOC

Tesco UK; Welwyn Garden City; Hybrid; GBP 60,000 - 80,000; Full time

Job summary

A major retail corporation is seeking an experienced Incident Manager to lead cybersecurity incident management. You will coordinate efforts across various teams to ensure an effective response to cyber threats. Strong leadership and communication skills required; familiarity with cybersecurity tools and frameworks is essential. This role supports flexible working patterns, blending office and remote work.

Benefits

Flexible working patterns

Inclusive culture

Qualifications

• Experience in leading and coordinating incidents across multiple geographies.
• Proven ability to manage multiple incidents simultaneously.
• Strong communication skills for incident updates with stakeholders.

Responsibilities

• Lead incident management activities across various teams.
• Ensure clear communications during incidents and post-incident reviews.
• Develop and conduct incident management exercises and trainings.

Skills

Incident coordination

Expertise in leadership

Proficiency in communication

Crisis management

Cybersecurity tools knowledge

Tools

EDR

SOAR

SIEM

Job description

Overview

Our Security Operations Centre (SOC) leads the monitoring and investigation of cybersecurity incidents for the Tesco Group. We work closely with Incident Managers and other cybersecurity teams, including Digital Forensics and Incident Response, Threat Intelligence, Automation and Detection Engineering, to protect, detect, and respond to security threats across Tesco’s diverse and evolving estate. Beyond investigating security incidents, we focus on continuous improvement of our overall security capabilities through our expertise and collaboration.

We are seeking an experienced Incident Manager to effectively resolve cybersecurity incidents. As Incident Manager, you will be at the forefront of handling incidents, coordinating efforts across various teams and geographies, and communications to ensure swift and effective responses to minimise the impact of cyber threats. We build strong relationships and work across the Tesco Group and subsidiaries, third-party service providers, and a wide range of technical specialists. We regularly participate in cybersecurity exercises, training, and personal development to maintain and build technical proficiency.

Day to day, you will use our broad technical knowledge and extensive experience in incident management and security operations to guide our teams through effective incident handling. Apply critical thinking skills to coordinate and resolve incidents and collaborate with security colleagues and partners to maintain a comprehensive view of emerging incidents and the threat landscape.

Responsibilities

• Following our Business Code of Conduct and always acting with integrity and due diligence.
• Leading incident management activities in a large complex operational landscape and in multiple geographies.
• Lead security incidents ensuring a coordinated approach to ensure a comprehensive and efficient response and adhering to the incident lifecycle.
• Handling multiple incidents simultaneously, ensuring each is managed effectively and efficiently.
• Assembling timelines and owning all communications, during incidents.
• Taking ownership of briefings to the incident team, peer security teams, and senior leadership.
• Organising the transition from active incident response to business as usual.
• Handling high stress situations with composure, efficiency, and integrity, whilst recognising natural human responses, and maintaining team morale.
• Developing cyber incident management exercises and training to test our response to threats like ransomware, insider threats, and Business Email Compromises.
• Develop, implement, and maintain policies, standards, and procedures for incident management.
• Regular reporting of incident patterns and trends to peers and senior leadership.
• Drive continued development of security operations incident response capabilities and consider how technologies, such as automation and AI, can improve ways of working.
• Work closely with teams across cyber security, technology and beyond.

Qualifications

• Experience in successfully leading and coordinating incidents across multiple geographies.
• Expertise in coordinating and managing multiple incidents simultaneously.
• Proven leadership skills to maintain team morale and manage natural human responses during high-stress incidents.
• Proficiency in capturing timelines, managing all communications ensuring clarity and accuracy during incidents.
• Familiarity with cybersecurity tools and platforms and cyber threat intelligence used in incident management.
• Conducting post-incident reviews and capturing lessons identified and lessons learned.
• Experience in coordinating the transition from active incident response to business as usual.
• Superb communication skills for briefing on incident updates and emerging patterns and trends to stakeholders inc. senior leadership.
• Ability to handle high-stress situations with composure, efficiency, and integrity.
• Experience in developing and conducting incident management exercises and training.
• Strong understanding of incident response frameworks (e.g., NIST, MITRE ATT&CK).
• Skills in developing, implementing, and maintaining policies, standards, and procedures for incident management and awareness of regulatory requirements and legal considerations related to incident management.
• Knowledge of how technologies, such as automation and AI, can improve incident response and ways of working.
• Familiarity with the most recent security threats affecting large enterprises, incident lifecycle, and standard methodologies for managing incidents.
• Comprehensive understanding of a large, complex operational landscape and emerging attack vectors, trends, and developments in cybersecurity.
• Ability to establish relationships with internal colleagues and externals partners, including third-party service providers and vendors.
• Experience with a broad range of security and non-security related enterprise technologies (e.g., EDR, SOAR, and SIEM).
• Desirable - completion of relevant training courses such as the SANS GIAC LDR553, SEC504, FOR508, FOR572; certifications (or equivalents) are desirable but not a requirement.

Our vision at Tesco is to become every customer's favourite way to shop, whether they are at home or out on the move. Our core purpose is ‘Serving our customers, communities and planet a little better every day’. Serving means more than a transactional relationship with our customers. It means acting as a responsible and sustainable business for all stakeholders, for the communities we are part of and for the planet.

We are proud to have an inclusive culture at Tesco where everyone truly feels able to be themselves. At Tesco, we not only celebrate diversity, but recognise the value and opportunity it brings. We’re committed to creating a workplace where differences are valued, and make sure that all colleagues are given the same opportunities. We’re proud to have been accredited Disability Confident Leader and we’re committed to providing a fully inclusive and accessible recruitment process. For further information on the accessibility support we can offer, please click here.

We’re a big business and we can offer a range of diverse full-time & part-time working patterns across our many business areas, which means that we can find something that works for you. We work in a more blended pattern - combining office and remote working. Our offices will continue to be where we connect, collaborate and innovate. If you are applying internally, please speak to the Hiring Manager about how this can work for you - Everyone is welcome at Tesco.