Lead Security Incident Response & Automation

JD.com Inc.; Greater London; On-site; GBP 90,000 - 130,000; Full time

Job summary

JD.com Inc. seeks a security lead to own end-to-end incident response in a 24/7 on-call model across global environments, operating during EMEA business hours. You will drive DFIR investigations, build automation and AI-assisted workflows, and collaborate with Threat Intelligence to strengthen detection coverage.

You will mentor engineers, develop runbooks, and help scale detection and response systems while applying MITRE ATT&CK knowledge to evolving adversary tactics.

Qualifications

• Experience in security incident response and investigations in cloud-first environments.
• Hands-on experience with SIEM, EDR, and/or detection engineering.
• Experience with cloud platforms (AWS & GCP).
• Familiarity with threat intelligence and adversary tactics (MITRE ATT&CK).

Responsibilities

• Lead and coordinate end-to-end incident response for high-severity security events within a 24/7 global on-call model, with this role operating during EMEA business hours.
• Prepare clear executive communications that keep stakeholders informed during incidents.
• Investigate complex security incidents across cloud environments, applying strong DFIR methodologies.
• Build and enhance automation and AI-assisted workflows to improve triage, investigation speed, and response consistency.
• Partner with Threat Intelligence to contextualize threats and improve detection coverage.
• Conduct root cause analysis (RCA) and lead post-incident reviews to drive continuous improvement and risk reduction.
• Develop and maintain runbooks, playbooks, and operational documentation.
• Mentor other engineers and help elevate the team’s overall incident response maturity

Skills

Security incident response

DFIR

Cloud security

Automation

Scripting (Python)

SOAR platforms

Threat intelligence

Executive communication

High-severity incident handling

Tools

SIEM

EDR

SOAR

AWS

GCP

Python

Job description

JD.com Inc. seeks a security lead to own end-to-end incident response in a 24/7 on-call model across global environments, operating during EMEA business hours. You will drive DFIR investigations, build automation and AI-assisted workflows, and collaborate with Threat Intelligence to strengthen detection coverage.

You will mentor engineers, develop runbooks, and help scale detection and response systems while applying MITRE ATT&CK knowledge to evolving adversary tactics.