Senior Manager, Incident Response

About the role

Grant Thornton Australia is expanding its incident response capability for an AI-enabled threat world and is looking for a commercially astute Senior Manager to lead it on the ground. The role leads client incident response engagements end to end, from triage and containment through to eradication, recovery and post-incident review, and acts as incident lead and senior escalation point for major client incidents. It is a full-time, permanent position with hands-on leadership and career progression.

Key responsibilities

• Lead client incident response engagements end to end, and coordinate response across client teams, legal counsel, insurers, managed security service providers and other third parties.
• Work with client executives and crisis management teams, aligning response with business continuity and executive decisions.
• Lead and mentor a team of incident response specialists across digital forensics, threat intelligence and threat hunting, including their development and career progression.
• Manage investigations, assign the right people and document actions according to established processes, standards and frameworks.
• Prepare and review technical reports and executive summaries for boards and executives.
• Use threat intelligence and proactive threat hunting to help clients prepare for, prevent and identify threats.
• Help clients prepare before an incident through readiness assessments, incident response plans, playbooks, escalation processes and tabletop exercises.
• Shape automation and AI-enabled workflows while keeping human oversight, governance and accountability.
• Build client relationships, identify follow-on opportunities and contribute to proposals, retainers and sustainable service delivery.
• Contribute to practice development, including playbooks, procedures, technology partners and onboarding new people.
• Take part in an on-call roster and travel for client work.

Required profile

• Significant experience leading cyber security incident response, in consulting, an in-house CSIRT or a SOC.
• Hands-on depth across incident management, digital forensics, threat intelligence and threat hunting.
• Track record of leading and developing teams.
• Experience working with external stakeholders such as executives, legal counsel, insurers and MSSPs.
• Australian citizenship or permanent residency.
• Willingness to travel and join an on-call roster.

Required skills

• Strong understanding of incident response frameworks and best practice, and of Australian regulatory and breach notification obligations.
• Experience with platforms and tooling behind modern detection and response.
• Commercial awareness of how engagements and retainers are scoped, priced and delivered.
• Nice to have: experience with cyber insurers or legal counsel on breach response, tabletop exercise design, and certifications such as GCIH, GCFA, GCFE, GREM, CISSP or equivalent.