Senior Incident Response Lead | Forensics & Team Leader

SGS; Centurion; On-site; ZAR 1,200,000 - 1,800,000; Full time

Job summary

SGS is seeking a senior incident response leader to head CyberCom's IR investigations. You will lead complex ransomware and enterprise-wide breaches, direct and review the work of responders, and ensure defensible, timely findings for clients.

You will manage the IR team, run on-call rosters, and develop development plans while coordinating with breach counsel, insurers and customers. This role requires travel within South Africa and regionally.

Qualifications

• 10+ years in cyber security with 7+ years hands-on IR/forensics.
• 3+ years managing a technical team.
• Lead investigator on ransomware and enterprise-wide compromises.
• Expert in Windows, Linux and cloud forensics (M365/Entra ID, Azure, AWS).
• Proficiency with standard forensic tooling and scripting (Python or PowerShell).
• Rigorous evidence handling, chain of custody and report writing.

Responsibilities

• Lead complex investigations hands-on and direct timelines, priorities and reporting.
• Manage IR team: allocate cases, track progress, and run on-call roster.
• Maintain IR methodology, playbooks and ISO/IEC aligned practices.
• Provide client-facing briefings and sign-off reports.
• Evaluate tooling and keep talent current on attacker TTPs.

Skills

Incident response leadership

Digital forensics

Team management

Windows forensics

Linux forensics

Cloud forensics

Evidence handling

Report writing

POPIA knowledge

Scripting (Python/PowerShell)

Education

Bachelor's degree in CS/IS/forensics

Senior IR/forensics certification

Degree or diploma in CS/forensics

Tools

Magnet AXIOM

EnCase

X-Ways

Velociraptor

KAPE

Volatility

Job description

SGS is seeking a senior incident response leader to head CyberCom's IR investigations. You will lead complex ransomware and enterprise-wide breaches, direct and review the work of responders, and ensure defensible, timely findings for clients.

You will manage the IR team, run on-call rosters, and develop development plans while coordinating with breach counsel, insurers and customers. This role requires travel within South Africa and regionally.