Senior Cyber Incident Responder

About the role

The Senior Incident Responder role will sit within our Cyber Defence Department. It is a hands-on technical role which also requires operational management skills.

We are looking for someone who has a strong technical background, with significant experience across all types of incident responses inclusive of cloud and can demonstrate adherence to digital forensic principles and procedures.

The right candidate will be able to work alongside senior stakeholders across the business and our other department technical teams. When not responding to and managing incidents, you will be expected to participate in threat hunting, alongside driving forward the IR team with their strategic mission, consisting of constant reviews of processes and procedures, developing new playbooks, running business-wide tabletop sessions (including extinction-level attacks), and assessing our overall incident response maturity levels. 

Being able to distil technical information to non-technical members of Admiral is vital. The successful candidate not being afraid to question what is being presented to them, constantly searching for answers to “why” something has happened and persisting with the resolutions to stop it from happening again. 

Essential Experience and Skills:

• 4+ years of experience conducting incident response management and investigations. 
• Demonstrated experience with digital forensic practices, including report writing. 
• Strong knowledge of multi-cloud incident response, including but not limited to: 
  • Investigation into relevant logs such as Prisma, Sentinel, Defender, etc.
  • Cloud-native automation of containment activities. 
  • Collaboration with application and infrastructure to understand cloud attack vectors and security measures required.
  • SaaS application investigations and relationship management. 
• Proficiency with Windows/Linux/Mac operating systems. 
• Experience in reverse-engineering malware samples and C2 protocols, including but not limited to:
  • Reverse engineering recently discovered malware variants and their respective C2 infrastructure and targets. 
  • Research into the latest malware detection evasion techniques.
  • Creation of detection rules and/or provide detection or blocking recommendations. 
• Practical programming knowledge or experience in writing scripts in languages such as Python, PowerShell, and Bash. 
• Broad understanding of networking and common enterprise technologies. 
• A demonstrable understanding of the Cyber Kill Chain, MITRE ATT&CK and other information security defence and intelligence frameworks. 
• To be able to demonstrate a professional, calm, and expert manner consistently while also showing leadership during stressful situations. 
• Proven experience in driving strategic goals and stakeholder management, including third-party relationships. 
• Certifications such as GCIH, GCFA, GNFA, and GDAT. 

Our Commitment to You

At Admiral, we are committed to being a diverse and inclusive workplace. Admiral is proud to be an equal opportunities employer and does not discriminate on the basis of race, sex (including pregnancy, childbirth, reproductive health decisions, or related medical conditions), national origin, gender, gender identity, sexual orientation, disability, age, or any other legally protected status.

All qualified applicants will receive equal consideration for employment.

Salary, Benefits and Work-Life Balance

We do not have a set salary for this position, as it will be dependent on the successful candidate’s experience. We are happy to see CVs from all candidates who meet the requirements and will be happy to discuss the remuneration package.

At Admiral, we are proud to be a diverse business where we put our people and customers first. We have great benefits to ensure employees have a great work-life balance; it's one of the reasons we’re consistently voted one of the Sunday Times Best Big Companies to Work For in the UK. We want you to have an element of freedom to define a working lifestyle that supports this, so accommodate flexible hours wherever possible.

All colleagues will receive 33 days holiday (including banks holidays) when they join us, and this will increase with length of service, up to a maximum of 38 days (including banks holidays). You also have the option to buy or sell up to five days of annual leave in addition to your allocation.

You can also view some of our other key benefits here.

#LI-NT1