Incident Responder (UK)

Outbreach Ltd.; United Kingdom; Hybrid; GBP 100,000 - 140,000; Full time

Benefits offered by this job

Hybrid work

Stock options

Training budget

Flexible hours

Job summary

Outbreach Ltd. is seeking an Incident Responder to lead the restoration of clients' IT systems after cyber-attacks. You will work with Incident Managers and coordinate with forensic, legal, PR and other specialists to ensure a rapid, thorough response.

The role requires 3+ years in incident response and strong knowledge of MITRE ATT&CK, cloud security, and BC/DR. Hybrid working model with generous training and stock options is offered.

Qualifications

• 3+ years as a cyber incident responder.
• 5+ years in a technical support or engineering role (or demonstrable advanced technology knowledge).
• Strong knowledge of operational security across multiple platforms and all major cloud providers.
• Certifications such as GCIH, GCIA or GCFA/E.
• Huge passion for cyber security demonstrated by research, testing or other activities.
• Advanced knowledge of MITRE ATT&CK framework and common TTPs.
• Extensive experience with Business Continuity and Disaster Recovery.
• Incredibly methodical and attentive to the smallest of details.
• Strong communication skills and presentable to clients and senior executives.

Responsibilities

• Lead the restoration of client IT systems after a cyber-attack.
• Triage initial calls with Incident Manager.
• Assess IT state, report damage and exposure.
• Implement temporary infrastructure to sustain operations during incidents.
• Collect and analyse intrusion artefacts (logs, malware, etc.).
• Conduct root-cause analysis of attack paths and lateral movement.
• Remediate vulnerabilities to prevent reinfection.
• Collaborate with Forensic, Legal, PR and 3rd parties on response.

Skills

Incident response

Tech background

Cloud security

Certifications

MITRE ATT&CK

BC/DR

Attention to detail

Client comms

Job description

The Incident Responder (IR) is the main person responsible for the technical operational tasks necessary to provide our clients with a high quality, rapid and comprehensive response to a breach. They will be at the forefront of all incidents and absolutely critical to the successful resolution. They will be intimately familiar with a wide variety of attacks from Ransomware to BEC, insider threat and DDoS to name just a few examples.The IR will be expected to work closely with Incident Managers and feed information to/from specialists in other areas of the incident response such as forensic, legal or PR.The IR will be able to handle pressure, multiple conflicting demands, and possibly chaotic environments with limited knowledge of the company or crisis. They will be expected to help bring order to the incident and contribute to the swift attainment of the client’s objectives.

Key Responsibilities

• First and foremost, this role is responsible for leading the restoration of our client’s IT systems after a cyber-attack.
• Working with the Incident Manager to help triage an initial call.
• Assess the state of the IT systems, report on the damage incurred and any other exposure.
• Implement temporary infrastructure to sustain key business operations during the incident.
• Collect and analyse intrusion artefacts such as logs, source code, malware etc.
• Conduct a root cause analysis to determine how the attack happened, any lateral movement or infection.
• Fully ‘clean’ and remove any residual infection, malware or other damage caused by the attacker.
• Ensure that vulnerabilities are remediated to prevent future reinfection by the same or similar method.
• Collaborate with Forensic, Legal, PR, Comms and 3 rd parties to ensure a comprehensive response.
• Monitor external sources to determine threats, evidence of breaches and breach impact.
• Document response activities, findings and recommendations.

Non-Incident Response / Crisis Management Responsibilities

• Engage with proactive audit and investigations to plan for a breach.
• Conduct threat hunting and other pre-breach or breach confirmation operations.
• Help to refine and improve playbooks, runbooks, and overall response methodology.

Skills & Experience

• 3+ years as a cyber incident responder.
• 5+ years in a technical support or engineering role (or demonstrable advanced technology knowledge).
• Strong knowledge of operational security across multiple platforms and all major cloud providers.
• Certifications such as GCIH, GCIA or GCFA/E.
• Huge passion for cyber security demonstrated by research, testing or other activities.
• Advanced knowledge of MITRE Att&ck framework and common TTPs.
• Extensive experience with Business Continuity and Disaster Recovery.
• Incredibly methodical and attentive to the smallest of details.
• Strong communication skills and presentable to clients and senior executives.

Highly Desirable but not Vital

• Experience gained from a consultancy or highly regulated organisation.
• Experience working in a 24/7 operation.
• Previous experience as a SOC analyst or Red Team.
• Risk and Compliance practices.
• Working knowledge of Public Relations, Communications, Marketing and Law.
• Experience within high pace, high pressure environments and desire to work in incidents and crisis management.
• Security Clearance.

Commitment

As a ‘bench’ Incident Responder you will be called whenever a suitable incident is raised by our clients which matches with your skill and experience level.

There is no expectation for you to remain on call or for you to accept any incident when you are not available. However, once you commit to an incident you will become a key member of the response team and will be expected to remain engaged for the duration of the incident. At the least this would be for 1 day, but in most cases will likely be for 2-4 weeks.

Full training and support will be provided to successful candidates who will be expected to attend regular (paid) meetings to ensure they are familiar with the company, its methodologies and market.

• Hybrid working with much of your work being done where you please.
• Flexible hours that can be scaled up or down as suits you.
• Working in an expanding Cyber Security business where you can grow in your career and where you can help shape the business.
• Training and development budget aligned to formal relevant qualifications.
• Hourly pay equivalent to over £120,000pa with a significant increase for unsociable hours – if needed.
• Eligible for company stock options (subject to minimum hours).