Cyber Operations and IR Manager

About this role

This is a broad cyber operations leadership role with significant autonomy. You will report directly to the CISO and manage a team of 4 within cyber defence.

You will work in a small, high-impact team with opportunity to influence and mature a global cyber defence capability.

You must have

• Cyber operations or security operations leadership experience.
• Hands-on exposure to incident response and endpoint security.
• Experience leading real security incidents (technical and stakeholder leadership).
• Strong understanding of common cyber threats, attack techniques, and mitigations.
• Broad technical knowledge across areas such as:
• Active Directory security
• Endpoint detection & response
• Cloud and identity security concepts
• Vulnerability management
• Security tooling integration
• Ability to manage both people and operational delivery in a small team environment.
• Strong stakeholder communication skills; must be able to engage both technical teams and business leaders.

Nice-to-Have

• CrowdStrike Falcon administration or investigation experience.
• Microsoft Defender and KQL query experience.
• Detection engineering or SIEM content development exposure.
• Experience in smaller or mid-sized organisations where multiple security disciplines are combined.
• Familiarity with AI-assisted security operations tooling (Copilot, Claude, threat intelligence automation, etc.).

About cyber security & digital forensics roles for ex-police

Cyber security, digital forensics and incident-response roles. DMIs, cybercrime investigators and digital forensics officers bring evidential discipline and investigative judgement that DFIR and security teams struggle to hire.