Incident Response Engagement-Lead

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Incident Response Engagement-Lead based in the United States. This role leads complex cyber incident engagements from initial scoping through containment, eradication, and recovery. You will act as a central liaison between claims teams, legal counsel, incident response providers, and affected policyholders. The position combines hands-on digital forensics expertise with project leadership, consulting, and stakeholder management. You will oversee external forensic investigations, manage timelines and scope, and ensure findings are translated into actionable insights. The role requires confidence working in legally sensitive environments where accuracy, discretion, and clear communication are essential. You will collaborate across technical, legal, claims, underwriting, and external partner teams during high-pressure situations. You will also contribute to improving incident response methodologies, playbooks, and tools within a growing cyber resilience environment. \n Accountabilities: - Lead and coordinate the full incident response lifecycle, including scoping, containment, eradication, and recovery, across moderately complex, multi-system environments. - Serve as the primary point of contact for claims teams, breach counsel, incident response providers, and policyholders throughout active cyber incident engagements. - Manage and oversee digital forensics and incident response providers, ensuring investigations are appropriately scoped, timely, accurate, and aligned with engagement objectives. - Identify, track, and actively manage scope changes and potential scope creep across multiple concurrent engagements while maintaining timelines and stakeholder alignment.

- Schedule, coordinate, and facilitate briefings on complex forensic findings, translating technical investigation results into clear and actionable reporting for technical, legal, and executive audiences. - Work effectively within legally sensitive investigations, applying an understanding of Attorney-Client Privilege and Work Product Doctrine in coordination with legal counsel. - Collaborate with claims adjusters, underwriters, external partners, and other stakeholders to support accurate incident documentation and informed coverage determinations. - Contribute to the ongoing development and improvement of incident response methodologies, playbooks, processes, and tooling. Requirements: - 4–6 years of hands-on experience in digital forensics and incident response (DFIR), with meaningful exposure to the cyber insurance ecosystem, including experience working with or on behalf of insurance carriers, breach counsel, and/or policyholders. - Demonstrated experience managing cyber incidents through scoping, containment, eradication, and recovery. - Proven ability to lead moderately complex, multi-system investigations while applying strong project management skills and proactively controlling scope. - Experience working in legally sensitive environments, with an understanding of Attorney-Client Privilege and the Work Product Doctrine. - Strong consulting, communication, and stakeholder management skills, including the ability to present forensic findings to technical, legal, and executive audiences. - Ability to remain organized, decisive, and detail-oriented while managing multiple concurrent engagements in high-pressure incident response situations. - A bachelor’s degree in Cybersecurity, Information Security Management, Digital Forensics, Computer Science, or a related discipline is preferred. - Equivalent professional experience may be considered in lieu of a degree, particularly when combined with relevant industry certifications such as GCIH, GNFA, CompTIA CySA+, CISM, or CISSP.