Incident Response Lead & Threat Hunter

DEFEND; Wellington; Hybrid; NZD 140,000 - 210,000; Full time

Benefits offered by this job

KiwiSaver 3.5%

Health Insurance - Southern Cross

Mobile & Broadband discounts

Flexible, hybrid work environment

Home office setup allowance

Employee Assistance Program (EAP)

Job summary

DEFEND is seeking an Incident Response Lead to guide organisations through critical cyber events. You will coordinate major incident response engagements, perform proactive threat hunting, and conduct compromise assessments to surface hidden intrusions before escalation.

This role blends frontline incident leadership with SME-level guidance for customers and DEFEND peers. You'll lead complex investigations end-to-end, drive recovery with clarity, and strengthen cyber resilience while mentoring

Qualifications

• Proven track record leading and coordinating major incident response engagements across customer environments.
• Hands-on digital forensics across endpoint, network and cloud.
• Strong threat hunting skills and ability to form/test hypotheses.
• Experience applying NIST/SANS frameworks during live incidents.

Responsibilities

• Coordinate major cyber incidents from initial investigation through containment and recovery.
• Conduct in-depth investigations using forensic evidence to determine attacker access.
• Hunt for threats using threat intelligence and adversary behaviour.
• Lead compromise assessments and threat hunts to identify current or historic intrusions.
• Translate technical findings into clear executive-facing recommendations.
• Mentor teammates and improve incident response playbooks and processes.

Skills

Incident response leadership

Digital forensics

Threat hunting

NIST/SANS

Threat intelligence

Stakeholder communication

Mentoring & team development

Job description

DEFEND is seeking an Incident Response Lead to guide organisations through critical cyber events. You will coordinate major incident response engagements, perform proactive threat hunting, and conduct compromise assessments to surface hidden intrusions before escalation.

This role blends frontline incident leadership with SME-level guidance for customers and DEFEND peers. You'll lead complex investigations end-to-end, drive recovery with clarity, and strengthen cyber resilience while mentoring