Lead – Incident Response & Digital Forensics

CPX is seeking a senior, commercially minded IR professional to lead its Incident Response (IR) and Digital Forensics (DFIR) practice. The successful candidate will combine hands-on technical credibility, crisis leadership and business-building capability to protect government, critical infrastructure and enterprise clients. The Director will serve as the designated CPX Incident Commander for major cyber incidents, leading coordinated response while growing an intelligence-led, AI-enabled incident response business.Mandate Requirement: -Typically, 12–15+ years in cybersecurity, with substantial direct DFIR and major incident experience and 5+ years leading teams or practices.Proven record acting as Incident Commander or equivalent lead during complex, high-severity cyber incidents.Deep expertise in enterprise, cloud, endpoint, network and identity investigations; familiarity with ransomware and advanced adversary tradecraft.Experience building or scaling a cyber services business, including commercial accountability, client engagement and operational performance.Strong judgement under pressure, executive communication and ability to coordinate technical and nontechnical stakeholders.Bachelor’s degree in cybersecurity, computer science, digital forensics or a related field, or equivalent demonstrable experience.Desirable Experience: -Government, regulated industries, critical national infrastructure or OT/ICS response.MSSP, consulting, national CERT or specialist DFIR practice leadership; retainer and partner ecosystem development.Cloud forensics (Azure/AWS), threat hunting, malware reverse engineering and AI-assisted security operations.Certifications such as GCFA, GCIH, GREM, GNFA, CISSP or CISM (valued, not mandatory).Measures of SuccessEffective major-incident command and response readiness; investigation quality and client confidence; growth and profitability of the IR portfolio; retainer adoption; talent development; and measurable improvements from intelligence integration and responsible automation.

Key Responsibilities

-Incident Command & Crisis LeadershipServe as CPX Incident Commander for major and critical cyber incidents, accountable for response strategy, command structure, prioritization, escalation, coordination and incident communications.Lead multidisciplinary teams spanning DFIR, SOC, Threat Intelligence, Threat Hunting, malware analysis, legal and client stakeholders; set clear objectives, roles, decision logs and reporting cadence.Direct investigations, containment, eradication and recovery planning for ransomware, identity compromise, data breaches, insider threats and sophisticated intrusions.Brief client executives and relevant authorities with accurate situation reports, business-risk assessments and recommended actions; lead post-incident reviews and improvements.For OT, safety-critical or business-disruptive actions, provide expert recommendations and coordinate decisions while respecting the client’s designated operational authority and approval requirements.Practice Strategy, Operations & GovernanceOwn the IR/DFIR strategy, operating model, service quality, 24/7 mobilization readiness and technical capability roadmap.Build expertise in endpoint, network, cloud and identity forensics, malware analysis, cyber crisis management and OT incident response.Maintain defensible forensic methodologies, chain of custody, evidence integrity, peer review and regulatory/contractual compliance.Develop response playbooks, exercises, quality controls, capacity plans, specialist partnerships and measurable service KPIs.Translate investigation findings into stronger SOC detections, proactive hunting, intelligence products and client resilience.Commercial Leadership & GrowthOwn the practice’s revenue, margin, utilization, delivery performance and agreed growth objectives.Scale incident response retainers, emergency response, forensic investigations, compromise assessments and readiness services.Partner with Sales, Presales and Account Management on strategic bids, proposals, pricing, client relationships and market development.Represent CPX as a trusted adviser to CISOs, executive leadership and government or critical-infrastructure stakeholders.Innovation & People LeadershipIntroduce secure AI-assisted triage, forensic correlation, investigation workflows and reporting, with human oversight, auditability and evidence integrity.Recruit, coach and retain high-performing incident responders and forensic specialists; build succession, training and a culture of accountability.Integrate IR with CPX Threat Intelligence, Threat Hunting and SOC teams to deliver a continuous intelligence-to-response improvement cycle.