This CIRT L3 Lead role is a hands-on leadership position responsible for end-to-end cyber incident response, proactive threat hunting, and detection engineering in Rapid7 InsightIDR for a retail-focused environment
My client is an international Consultancy firm, specialising in Cyber Security looking for a hands on Cyber Incident Response Tech Lead, responsible for end-to-end cyber incident response, proactive threat hunting, and detection engineering in Rapid7 InsightIDR for a retail-focused environment.
You will coordinate cross-functional technical teams during major incidents, drive containment and recovery, and own post-incident reviews and playbooks. The role includes mentoring CIRT analysts, enhancing SIEM/SOAR automation, and continuously improving processes using frameworks such as MITRE ATT&CK, NIST 800-61, and PCI DSS.
What this job is really about * Owning cyber incident response end-to-end: from first alert, through containment and eradication, to lessons learned and better playbooks.?

* Turning threat hunting into a core capability: hypothesis-driven, adversary-based hunts that actually find things, not just tick a process box.?

* Making Rapid7 InsightIDR work hard: building and tuning detection rules and UBA use cases so you see retail-relevant threats early and clearly.?

* Being the person who connects the dots between frameworks like MITRE ATT&CK, NIST 800-61, PCI DSS and what actually happens on the ground.

Who this will suit * You’ve worked in SOC, Incident Response, or Threat Hunting and are comfortable leading complex investigations, not just following a runbook.?

* You’ve used InsightIDR or another MDR/SIEM platform for rule creation, tuning and dashboards, and you’re not afraid of SOAR tools like InsightConnect or Cortex XSOAR.?

* Python or PowerShell are part of your toolkit, and retail networks, POS systems, and cloud infrastructure don’t intimidate you.?

* You can manage, coach, and challenge a CIRT team, handle stakeholders in the middle of a live incident, and still think strategically about where the function needs to go.?

Nice to have (but not deal-breakers) * Certifications such as GCIH, GCFA, CISSP, or Rapid7 InsightIDR Specialist.?

* A track record of improving processes, not just operating them - plus the communication skills to bring people with you.?

Robert Walters Operations Limited is an employment business and employment agency and welcomes applications from all candidates