Operations Lead - Incident Response

DEFEND; Wellington; Hybrid; NZD 150,000 - 210,000; Full time

Benefits offered by this job

3.5% KiwiSaver on top of base salary

Southern Cross Health Insurance

Mobile and broadband discounts

Flexible, hybrid work environment

Home office setup allowance

EAP services

Job summary

DEFEND is seeking an Incident Response Lead in New Zealand to guide organisations through critical cyber moments. You will coordinate major incidents, hunt threats that evade controls, and conduct compromise assessments.

You will mentor others, drive recovery with clarity, and strengthen resilience across DEFEND and client environments. You will lead investigations end-to-end, work hands-on with forensic analysis, and communicate findings to technical teams and executives with confidence in

Qualifications

• Proven experience leading and coordinating complex incident response engagements across customer environments.
• Strong hands-on digital forensics and investigative skills across endpoint, network and cloud environments.
• Sound working knowledge of incident response frameworks and methodologies such as NIST and SANS.

Responsibilities

• Lead major cyber incidents from initial investigation through containment and recovery.
• Conduct investigations, analyze forensic evidence, determine attacker access and next actions.
• Hunt threats using threat intelligence and adversary behavior to uncover bypassed controls.
• Oversee compromise assessments and threat hunts to reveal current or historic intrusions and exposure.
• Translate complex findings into clear guidance for technical teams and executives under pressure.
• Mentor teammates, improve playbooks and enhance incident response capabilities across the team.

Skills

Incident response leadership

Threat hunting

Digital forensics

Stakeholder communication

Incident coordination

Job description

At DEFEND, our dream is to improve everyday life by creating a cyber resilient world. We're looking for an Incident Response Lead to lead organisations through their most critical cyber moments. You will coordinate major incident response engagements, proactively hunt for threats that evade existing controls, and conduct compromise assessments that surface hidden intrusion before it escalates. This role is both a frontline leader during active incidents and a recognised subject matter expert for customers and DEFEND colleagues alike. You will be trusted to lead complex investigations end to end, drive recovery with clarity and precision, and strengthen cyber resilience in the face of evolving threats.

In this role you'll...

• Take the lead when it matters, coordinating major cyber incidents from initial investigation through containment and secure recovery.
• Get hands-on with complex investigations, working through forensic evidence to understand what happened, how far an attacker got, and what needs to happen next.
• Hunt for what others have missed, using threat intelligence and adversary behaviour to uncover threats that have bypassed existing controls.
• Lead compromise assessments and threat hunting to identify signs of current or historic intrusion and help customers understand their exposure and risk.
• Turn technical findings into clear advice, giving technical teams and executives the confidence to make decisions during high-pressure situations.
• Help build a stronger response capability, mentoring others and improving the playbooks, processes and approaches we use across incident response and threat hunting.

At DEFEND, our dream is to improve everyday life by creating a cyber resilient world. We're looking for an Incident Response Lead to lead organisations through their most critical cyber moments. You will coordinate major incident response engagements, proactively hunt for threats that evade existing controls, and conduct compromise assessments that surface hidden intrusion before it escalates. This role is both a frontline leader during active incidents and a recognised subject matter expert for customers and DEFEND colleagues alike. You will be trusted to lead complex investigations end to end, drive recovery with clarity and precision, and strengthen cyber resilience in the face of evolving threats.

In this role you'll...

• Take the lead when it matters, coordinating major cyber incidents from initial investigation through containment and secure recovery.
• Get hands-on with complex investigations, working through forensic evidence to understand what happened, how far an attacker got, and what needs to happen next.
• Hunt for what others have missed, using threat intelligence and adversary behaviour to uncover threats that have bypassed existing controls.
• Lead compromise assessments and threat hunting to identify signs of current or historic intrusion and help customers understand their exposure and risk.
• Turn technical findings into clear advice, giving technical teams and executives the confidence to make decisions during high-pressure situations.
• Help build a stronger response capability, mentoring others and improving the playbooks, processes and approaches we use across incident response and threat hunting.

Requirements

• Proven experience leading and coordinating complex incident response engagements across customer environments.
• Strong hands-on digital forensics and investigative skills across endpoint, network and cloud environments.
• Sound working knowledge of incident response frameworks and methodologies such as NIST and SANS, and the judgement to apply them while an incident is live.
• Strong threat hunting skills, able to form and test hypotheses, read adversary behaviour, and uncover threats that bypass preventative controls.
• Experience using threat intelligence to inform investigations, hunts, and assessments, and to anticipate how adversaries are likely to operate.
• Skilled at identifying control gaps and failures exposed by an incident and translating them into concrete recommendations that strengthen the organisation's defences.
• Excellent written and verbal communication, able to produce clear reports and brief both technical teams and executive stakeholders during and after an incident.
• Confident engaging stakeholders across technical and business teams, acting as a steady and trusted point of advice when an organisation is under active threat.
• Able to manage competing priorities and live incidents at once while keeping deliverables accurate and working to deadlines.
• A genuine focus on continuous improvement, refining documentation, processes, and detections based on what each engagement teaches.
• Strong leadership and collaboration skills, with a commitment to mentoring others, sharing knowledge, and lifting the capability of the team.
• Willingness to assist in other adjacent practices where time permits.

Benefits

About DEFEND:

Our dream at DEFEND is to improve everyday life by creating a cyber resilient world. Over the last few years, we've experienced phenomenal growth and winning several industry awards, including Microsoft's Global Partner of the Year for 2025!

Why DEFEND?

We believe in investing in our employees' growth and providing them with opportunities to advance their skills and careers. We offer a collaborative workplace culture, and we are committed to fostering an inclusive environment where innovative thinking is encouraged.

By joining our innovative and creative team you will have the opportunity to contribute a variety of cybersecurity outcomes, from culture & awareness of cyber resilience, through to offensive & defensive security. No matter what your role, everyone at DEFEND contributes towards our dream ofcreating a cyber resilient world.

The benefits of working at DEFEND

In addition to workingfor a growing, dynamic NZcompany, DEFEND offers the following benefits to all ourDEFENDers

• 3.5%Kiwisaveron top of your base salary
• Southern Cross Health Insurance coverage
• Mobile and Broadband discounts for yourself and family
• Flexible, hybrid work environment
• An allowance to contribute to your home office setup
• Access to EAP services to support youacross a range of wellbeing needs

Diversity & Inclusion:

At DEFEND, we celebrate a variety of perspectives and experiences. We know from experience that people from underrepresented groups often don't apply for roles they don't feel they meet all the criteria for. We're committed to creating an environment that enables all our team to thrive. If you think you have what it takes, but don't check every single box, please consider applying. We'd love to hear how you might contribute to the team and being our next DEFENDer.