Incident Response Lead

Forensic Focus; Auckland; On-site; NZD 90,000 - 140,000; Full time

Job summary

Forensic Focus in Auckland is seeking an experienced Incident Responder to lead engagements from initial investigation through containment and recovery, performing hands-on forensic analysis to determine attacker access and scope.

The role blends technical investigation with threat hunting, compromise assessments and direct communication with customers during critical incidents, with leadership and mentoring responsibilities beyond day-to-day SOC oversight.

Qualifications

• Hands-on digital forensics across endpoints, network and cloud environments.
• Strong threat hunting capabilities with incident response experience.
• Familiarity with MITRE ATT&CK, NIST and SANS frameworks.
• Ability to communicate technical findings to stakeholders clearly.

Responsibilities

• Lead incident response engagements from initial investigation through containment and recovery.
• Perform hands-on forensic analysis to determine attacker access and scope of compromise.
• Conduct proactive threat hunting and compromise assessments.
• Directly communicate findings and status to customers during critical incidents.
• Provide leadership, mentoring and customer-facing responsibilities beyond SOC oversight.

Skills

Incident response

Digital forensics

Threat hunting

MITRE ATT&CK

Communication

Job description

The Role

This role leads incident response engagements from initial investigation through containment and recovery, performing hands-on forensic analysis to determine how attackers gained access and the scope of compromise. It also involves proactive threat hunting, compromise assessments and direct customer communication during critical incidents.

Skills & Experience

Candidates need strong hands-on digital forensics experience across endpoint, network and cloud environments, plus threat hunting expertise. Familiarity with MITRE ATT&CK, NIST and SANS frameworks, attacker behaviour analysis, and the ability to communicate technical findings to stakeholders are essential.

Who It Suits

Ideal for an experienced incident responder ready to combine technical forensic work with leadership, mentoring and customer-facing responsibility, rather than purely overseeing a SOC team from a distance.