Security Incident Manager

We are seeking an experienced Security Incident Manager to lead and coordinate the end-to-end management of escalated information security events and incidents.

The role is responsible for ensuring that security incidents are effectively assessed, investigated, managed and resolved in accordance with established security incident management processes. Acting as the central coordination point, the Security Incident Manager will work closely with the Security Operations Centre (SOC), technical response teams, Legal, business stakeholders and senior leadership to ensure timely decision-making, effective incident response and appropriate risk management.

The successful candidate will take ownership of incident coordination from initial escalation through investigation, containment, remediation, recovery and formal closure, ensuring clear accountability, effective communication and comprehensive documentation.

Key Responsibilities

• Incident Management: Lead and coordinate the end-to-end management of escalated security events and incidents, ensuring timely assessment, classification, response, resolution and closure.
• Incident Response Coordination: Coordinate cross-functional incident response activities involving the SOC, IT Operations, technical specialists and other relevant teams, ensuring clear ownership, prioritisation and timely completion of actions.
• Investigation Oversight: Monitor technical investigations, containment, remediation and recovery activities, ensuring sufficient information is available to assess incident scope, root causes, business impact and required actions.
• Stakeholder Management: Act as the central coordination point for incident-related activities, facilitating discussions, decision-making and collaboration between technical teams, Legal, business representatives and senior management.
• Escalation and Risk Management: Assess incident impact and associated risks, ensuring significant issues are appropriately escalated and relevant decision-makers are engaged.
• Incident Communications: Coordinate internal and client-related incident communications, preparing clear and timely status updates, management briefings and executive summaries, in collaboration with Legal and relevant stakeholders.
• Documentation and Reporting: Maintain comprehensive incident records, including timelines, investigation findings, decisions, response actions and supporting evidence. Prepare incident closure reports and regular management reporting.
• Post-Incident Review: Coordinate root cause analysis and lessons-learned reviews, ensuring corrective and preventive actions are identified, assigned and tracked through completion.
• Continuous Improvement: Identify recurring incident patterns and opportunities to improve incident management processes, escalation procedures, response readiness and overall operational effectiveness.

Essential Skills and Experience

• Proven experience in cybersecurity incident management, incident response coordination or a similar information security role.
• Strong understanding of the security incident lifecycle, including investigation, containment, remediation, recovery and post-incident review.
• Good technical understanding of common cybersecurity threats, including malware, phishing, compromised accounts, unauthorised access, data breaches and insider threats.
• Demonstrated ability to coordinate complex incidents involving multiple technical, business and management stakeholders.
• Ability to interpret technical investigation findings and translate them into business risks, impacts and actionable management information.
• Strong understanding of incident classification, escalation procedures, risk management and evidence preservation.
• Excellent organisational, analytical and problem-solving skills, with the ability to manage multiple priorities and maintain oversight of ongoing incidents.
• Excellent written and verbal communication skills, including experience preparing incident reports and communicating with senior management.
• Ability to remain calm, objective and effective under pressure while handling sensitive and confidential information.

Desirable Skills and Experience

• Experience working within a Security Operations Centre (SOC), Incident Response Team or enterprise information security function.
• Familiarity with security technologies such as SIEM, EDR/XDR, threat intelligence and incident management platforms.
• Understanding of information security frameworks and standards, particularly ISO 27001 and recognised incident management practices.
• Experience coordinating external forensic investigations or incident response providers.
• Experience managing incidents involving personal data, client information or contractual and regulatory obligations.
• Relevant professional certifications such as CISM, CISSP, GCIH or equivalent.

Personal Attributes

• Strong sense of ownership, accountability and attention to detail.
• Excellent stakeholder management, communication and coordination skills.
• Calm and decisive under pressure, with sound judgement in complex situations.
• Proactive, analytical and solution-oriented approach.
• High standards of confidentiality, professionalism and integrity.

Discover some of the global benefits that empower our people to become the best version of themselves:

• Finance: Competitive salary package, share plan, company performance bonuses, value-based recognition awards, referral bonus;
• Career Development: Career coaching, global career opportunities, non-linear career paths, internal development programmes for management and technical leadership;
• Learning Opportunities: Complex projects, rotations, internal tech communities, training, certifications, coaching, online learning platforms subscriptions, pass-it-on sessions, workshops, conferences;
• Work-Life Balance: Hybrid work and flexible working hours, employee assistance programme;
• Health: Global internal wellbeing programme, access to wellbeing apps;
• Community: Global internal tech communities, hobby clubs and interest groups, inclusion and diversity programmes, events and celebrations.

At Endava, we’re committed to creating an open, inclusive, and respectful environment where everyone feels safe, valued, and empowered to be their best. We welcome applications from people of all backgrounds, experiences, and perspectives—because we know that inclusive teams help us deliver smarter, more innovative solutions for our customers. Hiring decisions are based on merit, skills, qualifications, and potential. If you need adjustments or support during the recruitment process, please let us know.