Incident Response Lead | Hybrid & Flexible

Morson Human Resources Limited; Glasgow; Hybrid; GBP 65,000 - 110,000; Full time

Job summary

SP Energy Networks (SPEN) in Glasgow is seeking an Incident Response Lead to strengthen our cyber security capabilities by developing, maintaining, and improving incident playbooks, runbooks, and procedures across OT and IT environments. You will collaborate with incident responders, detection engineers, and wider cyber teams to ensure playbooks are clear, repeatable, and aligned with best practice.

The role covers the full incident lifecycle, including post-incident reviews and exercises to

Qualifications

• Experience developing, maintaining, or executing incident response playbooks, runbooks, or procedures within a cyber security environment.
• Strong documentation skills - with the ability to translate complex technical activities into clear, structured, and usable operational guidance.
• Ability to plan, deliver, and evaluate incident response exercises - such as tabletop scenarios, simulation based drills, or cross team coordination activities - with a focus on validating playbooks and improving operational readiness.
• Demonstrable experience building effective relationships with technical and non technical stakeholders, with the ability to collaborate, influence, and communicate clearly during both day to day operations and during security incidents.
• A good understanding of the incident response lifecycle, common attack techniques (MITRE ATT&CK), and how incident response processes integrate with threat detection, monitoring, and wider security operations.

Responsibilities

• Develop, maintain, and continuously improve incident response playbooks, procedures, and documentation.
• Support the full incident lifecycle from preparation through post-incident reviews, driving improvements.
• Develop and deliver an incident response exercise plan covering tabletop scenarios and simulations.
• Engage with operational, engineering, legal, risk, communications, and technology stakeholders to align requirements and coordinate responses.
• Shape the wider strategy of the Incident Response function and contribute to capability uplift.

Skills

Incident response playbooks

Documentation

IR exercises

Stakeholder collaboration

MITRE ATT&CK knowledge

Job description

SP Energy Networks (SPEN) in Glasgow is seeking an Incident Response Lead to strengthen our cyber security capabilities by developing, maintaining, and improving incident playbooks, runbooks, and procedures across OT and IT environments. You will collaborate with incident responders, detection engineers, and wider cyber teams to ensure playbooks are clear, repeatable, and aligned with best practice.

The role covers the full incident lifecycle, including post-incident reviews and exercises to