Manager, Incident Response

arcticwolf; United States; Hybrid; USD 145,000 - 198,000; Full time

Job summary

Arctic Wolf in the United Kingdom is seeking a seasoned Head of DFIR to lead and mature a digital forensics and incident response practice. The role blends people management with hands-on technical leadership during high-stakes investigations.

You will deliver complex incident response services across ransomware, extortion, and business email compromise while maintaining operational excellence, quality standards, and clear executive communication.

Qualifications

• Proven leadership of DFIR or incident response teams across remote/hybrid staff.
• Hands-on expertise in host, network, and cloud forensics during major incidents.
• Ability to scope, plan, and deliver complex IR engagements with quality outputs.

Responsibilities

• Lead and mature a DFIR practice with people management and technical leadership.
• Oversee end-to-end incident response delivery across ransomware and extortion events.
• Establish KPIs, QA, reporting to drive scalable outcomes.
• Review reports and executive summaries for accuracy before release.
• Guide investigations across Windows, Linux, macOS, cloud platforms, containment to remediation.
• Contribute to practice growth through process development and knowledge sharing.

Skills

DFIR leadership

Incident response

Hybrid/remote team management

Cross-platform forensics

Cloud forensics

Executive communication

Job description

Role overview

Lead and mature a digital forensics and incident response (DFIR) practice based in the United Kingdom, combining people management with hands-on technical leadership during high-stakes investigations. The position is responsible for delivering complex incident response services across ransomware, business email compromise, cyber extortion, and large-scale recovery engagements while maintaining operational excellence.

Responsibilities

• Manage, mentor, and develop a hybrid/remote team of DFIR professionals, including hiring, onboarding, performance reviews, career planning, and succession activities.
• Oversee the end-to-end delivery of incident response services, scoping incoming matters, assigning personnel, balancing workloads, and stepping in as an escalation point during active engagements.
• Establish operational standards, quality assurance mechanisms, KPIs, and reporting capabilities that drive consistent, scalable outcomes and continuous improvement.
• Review incident reports, executive summaries, and customer deliverables to validate findings and ensure technical accuracy before release.
• Lead advanced forensic investigations across Windows, Linux, macOS, Azure, AWS, and Google Cloud environments, guiding containment, eradication, recovery, and remediation activities.
• Contribute to practice growth through process development, knowledge sharing, and collaboration with broader security operations stakeholders.

Requirements

• Demonstrated experience managing incident response or DFIR teams, including remote or hybrid personnel across multiple regions.
• Deep technical expertise in host, network, cloud, and log-based forensic analysis during major incidents such as ransomware or extortion events.
• Strong working knowledge of investigative tooling across enterprise operating systems and major cloud platforms.
• Proven ability to lead complex customer engagements, communicate findings to technical and executive audiences, and validate investigative conclusions produced by a team.
• Track record of building operational processes, service metrics, and quality assurance practices in a security services or managed detection context.
• Relevant professional background in cybersecurity, with eligibility to meet any applicable export control or background check requirements.

Nice to have

• Experience shaping training, mentoring, or peer-review programs that broaden team exposure to varied investigative work.

Benefits and work setup

• Hybrid/remote working arrangements based in the United Kingdom.
• Compensation package including base salary, variable incentive, and equity for all employees.
• 28 days annual leave plus 8 bank holidays and paid volunteering days.
• Pension plan with employer match and a comprehensive private benefits plan covering medical, optical, dental, life insurance, and income protection.
• Fertility support, paid parental leave, employee assistance programme with mental health services, and structured training and career development programmes.