Impress employers and recruiters.
Choose from hundreds of resume examples.

Target Resume Now

Tailor your resume to this Cyber Incident Response Lead role.

Rezi rewrites your resume against Colt Technology Services's job description. Free.

Resume score gauge reading 58 out of 100

Don't guess if your resume is good enough.

See how it scores against the Cyber Incident Response Lead posting at Colt Technology Services — free, in seconds.

About the Role

Colt is redefining its cyber security strategy and building an industry-leading incident response function. This role is central to that purpose, combining hands-on cyber investigation with incident leadership and coordination to manage incidents from detection to review.

Responsibilities

Analyze evidence from networks, endpoints, applications, identity systems, and cloud services using packet captures, logs, queries, and scripts to determine incident details, scope, and impact.
Coordinate technical and non-technical teams, set priorities, assign actions, and track progress, risks, and decisions during incidents.
Make timely containment decisions within delegated authority and agreed playbooks, balancing security benefits against service disruption.
Escalate decisions outside of delegated authority.
Communicate incident impact and available options to various audiences.
Collaborate with service owners to confirm threat removal, safe system restoration, and implement heightened monitoring.
Lead post-incident reviews and write comprehensive incident reports for technical and non-technical audiences.
Track agreed improvements through to completion.
Develop and maintain incident plans and playbooks, and lead or participate in tabletop exercises.
Identify detection gaps and automation opportunities, and collaborate with teams to enhance monitoring, detection, and response.
Participate in the incident response rota and respond to escalations outside normal working hours.
Mentor junior team members to maintain high standards of analysis and capabilities.

Requirements

Experience in investigating cyber incidents and coordinating responses across multiple teams.
Ability to provide timely and effective updates to senior leadership and business stakeholders during high-severity incidents.
Experience coordinating with third parties, suppliers, MSSPs, and specialist responders during investigations and recovery.
Good understanding of EDR products with demonstrated IR capability in Microsoft Defender, CrowdStrike, Sentinel One, or Trend Vision One.
Good understanding of SIEM tools with knowledge of Splunk, Google SecOps, or Sentinel.
Broad technical knowledge of networks, operating systems, applications, identity, and cloud environments.
In-depth understanding of common attacker techniques and demonstrated knowledge of MITRE ATT&CK, Cyber Kill Chain, or MITRE D3FEND.
Familiarity with IR tools such as tcpdump, Zeek, YARA, Nmap, with an emphasis on effective investigation skills.
Understanding of scripting languages (Python, PowerShell) for hypothesis testing, evidence analysis, and automation.
Ability to provide concise, accurate updates to both technical responders and non-technical decision-makers.
Experience performing cyber incident response within a telecommunications environment.
Knowledge of the Telecommunications Security Requirements.
Understanding of telecoms technology such as network technologies, authentication, and voice services.
Ability to conduct or coordinate threat hunting activities based on incident learnings, intelligence, and emerging threats.
Experience supporting purple team exercises and adversary simulations.
Experience using SIEM-less technologies to analyze data and identify security incidents.
Understanding and experience of automation tools and agentic capabilities to improve analysis, triage, containment, and remediation.
Experience leading or supporting cyber crisis management activities.
Experience working with external crisis IR retainer organizations.

Skills

Cyber Investigation
Incident Response
Incident Leadership
Coordination
Business Impact Analysis
Containment
Incident Review
Technical Analysis
Evidence Analysis
Network Analysis
Endpoint Analysis
Application Analysis
Identity System Analysis
Cloud Service Analysis
Packet Capture Analysis
Log Analysis
Scripting
Communication
Threat Removal Confirmation
Post-Incident Review
Incident Reporting
Incident Plan Development
Playbook Development
Tabletop Exercises
Detection Gap Identification
Automation Opportunity Identification
Monitoring Improvement
Detection Improvement
Response Effectiveness Improvement
On-call Rotation
Mentoring
EDR Products
SIEM Tools
MITRE ATT&CK
Cyber Kill Chain
MITRE D3FEND
IR Tools
Scripting Languages
Python
PowerShell
Threat Hunting
Purple Teaming
Adversary Simulation
SIEM-less Technologies
Automation Tools
Agentic Capabilities
Cyber Crisis Management

Location

Global

Work Type

Flexible working hours
Work from home option

Experience Level

Senior

Benefits

Flexible working hours
Option to work from home
Extensive induction program with experienced mentors and buddies
Opportunities for further development and educational opportunities
Global Family Leave Policy
Employee Assistance Program
Internal inclusion & diversity employee networks

About the Company

Colt provides network, voice and data centre services to thousands of businesses globally.
Colt empowers people and fosters a culture where employees are trusted and collaborate globally to create intelligent solutions.
Colt's global teams are driven by a shared purpose to put the power of the digital universe in the hands of customers.
Colt offers opportunities to inspire and lead teams on projects that connect people, cities, businesses, and ideas.

Equal Opportunity

Inclusion and valuing diversity of thought and experience are at the heart of Colt's culture.
Colt encourages employees to be themselves, believing this helps people thrive.
Colt welcomes people with diverse backgrounds and experiences, regardless of gender identity or expression, sexual orientation, race, religion, disability, neurodiversity, age, marital status, pregnancy status, or place of birth.
Colt has signed the UN Women Empowerment Principles which guide their Gender Action Plan.
Colt has trained 60 (and growing) Colties to be Mental Health First Aiders.
Colt provides support for recruitment process adjustments.
Information about Colt's Inclusion and Diversity agenda is available on their DEI pages.