Incident Response Lead — Hybrid, Playbooks & Readiness

Morson Edge; Glasgow; Hybrid; GBP 85,000 - 110,000; Full time

Job summary

SP Energy Networks (SPEN) is seeking an Incident Response Lead in Glasgow to strengthen and mature its cyber security incident response capabilities. You will develop and maintain playbooks, coordinate with responders and engineers, and drive continuous improvement across the incident lifecycle.

The role involves delivering a plan for incident response exercises, ensuring playbooks are effective, compliant with NIS regulations, and suited to evolving OT/IT environments.

Qualifications

• Experience developing, maintaining, or executing incident response playbooks in a cyber security environment.
• Strong documentation skills to translate complex technical activities into clear, usable guidance.
• Ability to plan, deliver, and evaluate incident response exercises (tabletop, simulations, cross-team drills).
• Proven ability to build relationships with technical and non-technical stakeholders during both routine operations and incidents.
• Solid understanding of the incident response lifecycle and MITRE ATT&CK framework.

Responsibilities

• Develop and maintain incident response playbooks and runbooks.
• Support the full incident lifecycle from preparation through post-incident review.
• Improve SPEN's cyber response framework and ensure NIS compliance and OT/IT alignment.
• Deliver incident response exercise plans across a range of scenarios to test readiness.
• Collaborate with business units to reflect real-world operational needs in processes.

Skills

Playbooks & runbooks

Documentation skills

Incident response exercises

Stakeholder management

MITRE ATT&CK familiarity

Job description

SP Energy Networks (SPEN) is seeking an Incident Response Lead in Glasgow to strengthen and mature its cyber security incident response capabilities. You will develop and maintain playbooks, coordinate with responders and engineers, and drive continuous improvement across the incident lifecycle.

The role involves delivering a plan for incident response exercises, ensuring playbooks are effective, compliant with NIS regulations, and suited to evolving OT/IT environments.