Incident Response Lead

Government Recruitment Service; Greater London; Sur place; GBP 59 000 - 71 000; Plein temps

Résumé du poste

The Government Recruitment Service is seeking an experienced Incident Response Lead in London to head investigations, forensic analysis, and the technical response to cyber incidents. The role requires Security Check clearance and NSV vetting, with leadership responsibilities over security analysts.

You will coordinate with other Cyber Defence functions, develop playbooks, and drive continual improvement of incident response capabilities across internal IT and citizen-facing services.

Qualifications

• SC clearance and NSV vetting process required.
• Proven experience leading incident response investigations.
• Ability to mentor and coach junior analysts.

Responsabilités

• Lead the investigation of security alerts to determine incident scope and impact.
• Lead forensic analysis of systems, files, network traffic and cloud environments.
• Lead technical response with containment, eradication and recovery actions.
• Support wider coordination of cyber incidents.
• Review previous incidents to identify lessons and actions.
• Identify and deliver opportunities for continual improvement of the incident response capability.
• Work closely with other Cyber Defence functions to improve capabilities.
• Develop and update internal plans, playbooks and knowledge base articles.
• Act as escalation point and mentor security analysts.
• Be responsible for leadership and line management of security analysts.

Connaissances

Incident response

Forensic analysis

Leadership

Mentoring

Description du poste

The Cyber Defence team delivers cyber threat intelligence, threat detection, incident response and vulnerability management capabilities for the Cabinet Office, and is responsible for defending both internal IT infrastructure and citizen-facing services. As a senior security analyst, you’ll take a leading role in building and delivering these core capabilities, focusing on incident response.

Important

This role requires SC (Security Check) which will be conducted by NSV (National Security vetting). You need to have been resident in the UK within the past five years in order to apply.

Here is a short video why this is required.

https://www.youtube.com/embed/lRit8RA7Zpo?si=hyV_Cmn3qTzVP3RO

• Lead the investigation of security alerts to understand the nature and extent of possible cyber incidents
• Lead the forensic analysis of systems, files, network traffic and cloud environments
• Lead the technical response to cyber incidents by identifying and implementing (or coordinating the implementation of) containment, eradication and recovery actions
• Support the wider coordination of cyber incidents
• Review previous incidents to identify lessons and actions
• Identify and deliver opportunities for continual improvement of the incident response capability
• Work closely alongside other Cyber Defence functions, supporting the continual improvement of wider capabilities
• Develop and update internal plans, playbooks and knowledge base articles
• Act as an escalation point for, and provide coaching and mentoring to, security analysts
• Be responsible for leadership and line management of security analysts

Proud member of the Disability Confident employer scheme

Incident Response Lead

Company: Government Recruitment Service Salary: £59,207 to £70,958 a year Hours: Full-time Location: London Job type: Permanent Posting date: 2 Nov 2026 Closing date: 22 Nov 2026

About Disability Confident

Disability Confident is a government scheme. It encourages employers to recruit and retain disabled people and those with long term health conditions.