Cyber Response and Recovery Manager - #2194060

Cyber Response & Recovery Manager (SC)

Lead the recovery when a client's worst day hits: rebuild, remediate and restore after ransomware and major cyber incidents, with one of the UK's Tier 1 incident response teams.

• Location: London (Canary Wharf) or Manchester, hybrid
• Salary: £76,208 – £84,676
• Grade: Manager, Cyber Advisory (Technology & Digital)
• Clearance: current SC or DV, or eligibility and willingness to obtain SC
• Travel and on-call: on-call rotation; short-notice travel for up to 2–3 weeks at a time

About the opportunity

Our client is one of only nine Tier 1 incident response providers in the UK, and its Cyber Response Services team is growing, with six new hires planned across grades. This Manager role focuses on what happens after an incident is contained: getting the business running again, safely, and making sure the attacker can't come back.

Clients turn to the team for ransomware, destructive malware, business email compromise, Active Directory compromise, cloud compromise and advanced network intrusions. You will turn incident findings into practical remediation, rebuild and recovery plans. You'll work alongside incident response leads, forensic teams, legal advisers, insurers and client executives. This is a hands-on recovery role, not a pure incident response one.

What you'll be doing

• Leading recovery workstreams during major incidents and post-incident remediation programmes
• Hands-on remediation across Active Directory, Windows and Linux, network, cloud, endpoint and security tooling, removing attacker persistence and restoring trust
• Driving patching and vulnerability remediation, prioritised by business risk and threat actor behaviour
• Reviewing and redesigning network architecture and security controls, including segmentation, firewall rules and administrative access paths, to reduce the risk of reinfection
• Building isolated recovery environments and secure rebuild strategies, including backup validation and restore sequencing
• Defining phased recovery and security improvement roadmaps, from immediate stabilisation to long-term transformation
• Managing delivery end to end: stakeholder communication, reporting, proposals and mentoring junior team members

Between incidents, you'll support clients with recovery readiness and resilience work, such as recovery playbooks, Active Directory resilience assessments and ransomware recovery planning. You'll also help build the team's own capability: playbooks, tooling, automation, lab environments and training.

What you'll bring

• Eligibility for SC clearance (existing SC or DV is beneficial)
• Significant, proven cyber security incident experience, including supporting recovery from ransomware, Active Directory compromise, network intrusion or large-scale infrastructure incidents
• Strong hands-on infrastructure skills across Windows Server, Active Directory, Linux, networking and cloud (Azure, AWS, Microsoft 365), able to work at sysadmin level during recovery
• Experience leading remediation: identity and AD hardening, patching, secure rebuild, backup validation and restoring business-critical services
• A solid grasp of network architecture and security, including segmentation and firewall design
• Excellent written and verbal communication, with the confidence to brief both technical teams and executives under pressure
• Project and delivery management skills, including managing multiple workstreams and cases at once
• Willingness to take part in the on-call rota and travel at short notice

Why join

• Work on nationally significant incidents for a Tier 1 provider, with exposure across government and critical infrastructure
• Shape a rapidly growing recovery capability rather than join a settled one
• Investment in certifications, training and technical growth
• A clear route into senior cyber response and recovery leadership

Location and working pattern

Hybrid, with about 60% of the week with clients or in the office and 40% elsewhere, including home. You must live within commuting distance of Canary Wharf, London or St Peter's Square, Manchester.