(Open to Associate Director with progression path to Director)
The purpose of this role is to lead NCC Group’s global Digital Forensics and Incident Response (DFIR) capability, ensuring effective preparedness, response, recovery, and continuous improvement across cyber incident management and forensic investigations. The global DFIR team will consist of regionally distributed colleagues, delivering a consistent, scalable, and market-leading service that protects client assets, reputation, and business operations. The role is responsible for setting strategic direction, driving operational excellence, evolving people, process and technology capabilities, and supporting commercial growth through the conversion of incident response engagements into ongoing security service opportunities.
The Director, DFIR will be responsible for ensuring robust cyber resilience capabilities, overseeing major cyber incidents, maintaining advanced forensic practices, and ensuring the function remains aligned with changing client requirements, regulatory obligations, and emerging cyber threats. The role also serves as a senior leader within the Cyber Intelligence and Response business, influencing stakeholders and driving continuous service improvement.
A key part of the role is engaging and collaborating with leaders across NCC Group to achieve the following ambitions:
- Define and execute a global DFIR strategy aligned to business priorities and risk appetite.
- Strengthen cyber incident preparedness, response, and recovery capabilities.
- Develop and scale advanced digital forensic capabilities across endpoint, network, and cloud environments.
- Embed lessons learned from incidents, exercises, and reviews into continuous improvement initiatives.
- Drive operational excellence through effective capacity planning, resource management, and performance measurement.
- Support business growth by identifying opportunities to transition incident response engagements into long-term security services.
-
Lead the global DFIR function, ensuring effective delivery of digital forensics and incident response services across multiple regions.
- Define and execute the global DFIR strategy, ensuring alignment with business objectives, client needs, and organisational risk appetite.
- Manage regional performance through effective resource planning, utilisation management, and alignment to revenue forecasts and delivery demand.
- Implement clear measures of capacity, utilisation, and operational performance to optimise scalability and efficiency.
- Drive effective offshoring strategies that balance quality, efficiency, and cost.
- Oversee the management of major cyber incidents and act as the senior escalation point during high-severity events.
- Ensure coordinated incident response across technical teams, business leadership, clients, and external stakeholders.
- Drive effective containment, remediation, recovery, and post-incident review activities.
- Lead the development of advanced forensic capabilities across endpoint, network, cloud, and emerging technology environments.
- Ensure forensic readiness, evidential integrity, and compliance with legal and regulatory requirements.
- Maintain incident response plans, playbooks, and testing programmes through simulations and exercises.
- Partner with Legal, Risk, Compliance, and senior business stakeholders to meet regulatory and client obligations.
- Define, measure, and report on key operational KPIs, including quality, responsiveness, accuracy, and customer satisfaction.
- Build, mentor, and lead a high-performing, diverse, and globally distributed DFIR organisation.
- Foster a culture of innovation, collaboration, continuous learning, and operational excellence.
- Represent NCC Group externally through industry forums, conferences, and customer engagements, demonstrating thought leadership in DFIR and cyber resilience.
-
Extensive experience leading Digital Forensics and Incident Response (DFIR) teams within complex cyber security environments.
- Proven experience developing and executing global operational strategies aligned to business objectives.
- Strong experience managing large-scale cyber incidents, breaches, and crisis response activities.
- Expertise in digital forensics across endpoint, network, cloud, and hybrid environments.
- Experience building, developing, and retaining high-performing technical teams across multiple geographies.
- Strong process improvement and operational transformation experience.
- Experience managing budgets, forecasting demand, and optimising resource allocation.
- Ability to influence and communicate effectively with executive stakeholders, clients, regulators, and technical teams.
- Strong written and verbal communication skills, with the ability to translate complex cyber security concepts into business-focused language.
- Experience leading organisational change and technology transformation initiatives.
- Experience within Managed Security Services (MSSP) or large-scale cyber security consulting environments.
- Experience supporting commercial growth, sales enablement, and service expansion opportunities.
- Strong knowledge of current cyber threat trends, regulatory requirements, and industry best practices.
- Active participation in industry forums, conferences, or recognised cybersecurity communities.
We have a high-performance culture which is balanced evenly with world-class well-being initiatives and benefits:
- Flexible Working: Balance your work and personal life with our flexible working options.
- Enhanced Holiday Allowance: Enjoy 25 days of holiday, plus bank holidays, with the option to buy up to 5 additional days of annual leave.
- Medicash & Critical Illness Scheme.
- Financial & Investment Benefits: Pension, Life Assurance, and Share Save Scheme.
- Community & Volunteering Programmes.
- Green Car Scheme.
- Cycle to Work Scheme.
- Special Time Off for important life events.
- Enhanced Family Planning, Maternity, and Paternity Support.
We assess, develop and manage cyber threats across our increasingly connected society. We advise global technology, manufacturers, financial institutions, critical national infrastructure providers, retailers and governments on the best way to keep businesses, software and personal data safe.
With our knowledge, experience and global footprint, we are best placed to help businesses identify, assess, mitigate & respond to the risks they face.
We are passionate about making the Internet safer and revolutionising the way in which organisations think about cyber security.
Headquartered in Manchester, UK, with over 35 offices across the world, NCC Group employs more than 2,000 people and is a trusted advisor to 15,000 clients worldwide.
We review every application received and will get in touch if your skills and experience match what we’re looking for. If you don’t hear back from us within 10 days, please don’t be too disappointed – we may keep your CV on our database for any future vacancies and we would encourage you to keep an eye on our career opportunities as there may be other suitable roles.
If you do not want us to retain your details, you can utilise the Manage Your Data tool provided by Pinpoint or contact us directly at:
[email protected]. All personal data is held in accordance with the NCC Group Privacy Notice.
We are committed to diversity and flexibility in the workplace. If you require any reasonable adjustments to support you during the application process, please tell us at any stage.
Please note that this role involves mandatory pre-employment background checks due to the nature of the work NCC Group does. To apply, you must be willing and able to undergo the vetting process.