Incident Response Lead - AI-Driven Cyber Security (Hybrid)

WTW; Greater London; Hybrid; GBP 90,000 - 130,000; Full time

Benefits offered by this job

25 days annual leave + extra WTW day

Private healthcare

Life insurance

Group income protection

Hybrid working options

Employee assistance programme

Volunteer day

Job summary

WTW’s Global Information and Cyber Security Defence (ICSD) seeks an Associate Manager - Cyber Security Incident Response based in London with hybrid working. You will lead significant security incidents, refine incident response processes, and drive AI-assisted containment and remediation.

You will coordinate cross-functional teams across the globe and interact with executives, Legal, HR and Compliance. You will also contribute to post-incident reviews, KPI development, and mentoring of team

Qualifications

• Strong work experience in SOC or incident response.
• Understanding of AI/ML applications in security operations.
• Hands-on cloud incident response across Azure, AWS, GCP.

Responsibilities

• Serve as the primary lead for significant security incidents and coordinate response.
• Establish and maintain incident response processes, playbooks, and workflows.
• Communicate with internal and external stakeholders, including executives, Legal, HR and Compliance.
• Lead in-depth technical investigations and ensure containment, eradication, and recovery.
• Coordinate global response teams and integrations with SIEM/SOAR and MSSPs.

Skills

SOC incident response

AI/ML in security operations

Cloud incident response (Azure/AWS/GCP

MITRE ATT&CK framework

leadership of security incidents

clear communication with execs

analytic and problem solving

mentoring junior staff

Tools

SIEM/SOAR platforms

MSSPs collaboration

Job description

WTW’s Global Information and Cyber Security Defence (ICSD) seeks an Associate Manager - Cyber Security Incident Response based in London with hybrid working. You will lead significant security incidents, refine incident response processes, and drive AI-assisted containment and remediation.

You will coordinate cross-functional teams across the globe and interact with executives, Legal, HR and Compliance. You will also contribute to post-incident reviews, KPI development, and mentoring of team