Lead Specialist, Incident Response

About the role

SITA is seeking a Lead Specialist in Incident Response to head its most critical cybersecurity investigations. The role involves owning high‑severity incidents from detection through containment, eradication, recovery and post‑incident review, while serving as Incident Commander for major cyber events.

Key responsibilities

• Lead the full incident response lifecycle for high‑severity and business‑critical cyber incidents.
• Act as Incident Commander, coordinating cross‑functional teams including SOC, Cloud & Infrastructure, Product Engineering, Legal, Compliance and Business stakeholders.
• Make rapid decisions during active incidents, ensuring clear communication and mitigation of business impact.
• Produce comprehensive incident reports, executive briefings and post‑incident reviews with actionable recommendations.
• Develop, maintain and continuously improve incident response processes, playbooks, runbooks and procedures.
• Facilitate tabletop exercises, simulations and cyber crisis response activities.

Required profile

• Extensive experience leading complex cybersecurity investigations and acting as senior technical escalation point.
• Proven track record as Incident Commander or equivalent leadership role in cyber incident handling.
• Strong collaboration skills with Security Operations, Cloud, Infrastructure, Product Security, Corporate IT and legal teams.
• Ability to influence and improve incident response maturity and forensic readiness across a large organization.

Required skills

• Digital forensics
• Incident response lifecycle management
• Threat hunting and insider‑threat analysis
• Cross‑functional coordination with SOC, Cloud, Infrastructure, Product Engineering and legal teams