Incident Response Lead for Cyber Resilience (Hybrid)

DEFEND Limited; Wellington; Hybrid; NZD 120,000 - 160,000; Full time

Benefits offered by this job

3.5% Kiwisaver on top of base salary

Southern Cross Health Insurance

Mobile & broadband discounts

Hybrid work environment

Home office setup allowance

Employee assistance program

Job summary

DEFEND is seeking an Incident Response Lead in Wellington to guide organisations through major cyber incidents. You will coordinate investigations, perform proactive threat hunting and compromise assessments, and translate technical findings into actionable guidance for customers and DEFEND colleagues alike.

You will lead complex investigations end to end, drive recovery with clarity and build resilience against evolving threats.

Qualifications

• Proven experience leading and coordinating complex incident response engagements across customer environments.
• Hands-on digital forensics across endpoint, network and cloud.
• Strong knowledge of incident response frameworks (NIST/SANS) and applying them live.
• Threat hunting and use of threat intelligence to inform investigations.
• Ability to translate technical findings into clear executive-level guidance.

Responsibilities

• Lead major cyber incidents from initial investigation through containment and recovery.
• Conduct complex investigations with forensics evidence to determine attacker extent.
• Hunt for threats using adversary behavior and intelligence to surface hidden activity.
• Lead compromise assessments and ongoing threat hunts for customers.
• Produce clear reports and brief executives and technical teams during incidents.
• Mentor teammates and improve playbooks and processes across IR and TH practices.

Skills

Incident response leadership

Digital forensics

IR frameworks (NIST/SANS)

Threat hunting

Threat intelligence

Root cause analysis

Clear technical reporting

Stakeholder engagement

Prioritisation under pressure

Mentoring & team uplift

Cross-environment investigations

Tools

End-to-end incident tooling

Forensic tooling

Cloud, network, endpoint security

Job description

DEFEND is seeking an Incident Response Lead in Wellington to guide organisations through major cyber incidents. You will coordinate investigations, perform proactive threat hunting and compromise assessments, and translate technical findings into actionable guidance for customers and DEFEND colleagues alike.

You will lead complex investigations end to end, drive recovery with clarity and build resilience against evolving threats.