Incident Manager (Cyber)

Location: Johannesburg (Hybrid/Remote)
Type: Permanent Senior Level

Redherd is a specialist cybersecurity recruitment and advisory firm working globally with consultancies MSSPs and enterprise organisations. We partner with high-performing teams across incident response DFIR offensive security and cyber strategy.

Our client is a specialist cybersecurity consultancy delivering incident response threat intelligence and advisory services to enterprise clients across regulated industries. They are known for operating at the sharp end of complex cyber incidents supporting organisations through high-impact events.

This is not a hands-on DFIR role but it does require strong operational leadership and sufficient technical understanding to effectively coordinate technical response teams during high-pressure incidents.

During active incidents you will act as the incident commander responsible for coordinating stakeholders driving decision-making managing communications and ensuring effective response execution under pressure.

Outside of incidents you will support clients in improving their incident management readiness including tabletop exercises playbooks incident management frameworks and readiness assessments.

Act as incident commander during major cyber incidents
Coordinate cross-functional teams including technical responders executives legal regulators and external stakeholders
Manage incident bridges communications cadence structured timelines and decision tracking
Maintain action trackers and incident logs throughout investigations
Guide clients through containment response recovery and return to business-as-usual
Support drafting and review of executive and external communications

Deliver executive and CSIRT tabletop exercises
Conduct incident readiness reviews and gap assessments
Develop and maintain incident management playbooks runbooks templates and reporting frameworks
Support onboarding and ongoing readiness activities for retained incident response clients

Contribute to the development of incident management methodologies
Support training and mentoring of junior incident management team members
Improve internal processes tooling and response frameworks

Proven experience leading or coordinating major incidents end-to-end
Background may include cyber incident response IT major incident management telecoms aviation healthcare military or emergency services
Strong ability to operate in high-pressure multi-stakeholder environments
Ability to remain calm structured and decisive during crisis situations
Sufficient technical literacy to understand and challenge the work of DFIR specialists without performing the investigation directly
Ability to interpret and discuss EDR alerts SIEM outputs ransomware activity credential compromise business email compromise and cloud-related incidents
Excellent written and verbal communication skills particularly for executive-level stakeholders
Experience managing incident communications reporting coordination processes and stakeholder updates

Familiarity with incident response frameworks such as NIST 800-61 or ISO 27035
Understanding of regulatory environments including POPIA and GDPR
Experience in consulting or client-facing environments
Exposure to cyber incident response or DFIR teams
Certifications such as SANS LDR553 / GIAC GCIL GCIH GCFA Security CEH or equivalent operational incident management certifications
Training or experience related to crisis leadership incident management or cyber response coordination

This role is best suited to individuals who:

Thrive in high-pressure high-impact environments
Are confident leading senior stakeholders during crisis situations
Can bridge the gap between technical teams and executive leadership
Have strong organisational and communication skills
Are calm methodical and decisive under pressure
Prefer coordination leadership and decision-making over hands-on technical investigation