Incident Response Lead — Playbooks, Exercises & Readiness

Morson Talent; Glasgow; Hybrid; GBP 83,000 - 124,000; Full time

Job summary

SP Energy Networks (SPEN) is seeking an Incident Response Lead to strengthen and mature the cyber security playbooks and response procedures. You will work with incident responders, detection engineers, and broader cyber teams to ensure processes are clear, repeatable, and compliant with best practices.

You will manage the full incident lifecycle from preparation to post-incident review, driving improvements and tailoring playbooks to evolving OT/IT environments.

Qualifications

• Experience developing or maintaining incident response playbooks or procedures in a cyber security environment.
• Excellent documentation ability to translate technical activities into clear guidance.
• Ability to plan and run incident response exercises (tabletop or simulations).
• Proven track record building relationships with technical and non-technical stakeholders.
• Understanding of incident response lifecycle, attack techniques (MITRE ATT&CK), and integration with threat detection.

Responsibilities

• Develop, maintain, and improve incident response playbooks and runbooks.
• Collaborate with incident responders and detection engineers to ensure clear, repeatable processes.
• Support the full incident lifecycle from preparation to post-incident review.
• Contribute to the maturity of SPEN's incident response framework and regulatory alignment.
• Design and deliver incident response exercise plans across scenarios to test readiness.

Skills

Incident response playbooks

Documentation skills

Incident response exercises

Stakeholder communication

MITRE ATT&CK knowledge

Job description

SP Energy Networks (SPEN) is seeking an Incident Response Lead to strengthen and mature the cyber security playbooks and response procedures. You will work with incident responders, detection engineers, and broader cyber teams to ensure processes are clear, repeatable, and compliant with best practices.

You will manage the full incident lifecycle from preparation to post-incident review, driving improvements and tailoring playbooks to evolving OT/IT environments.