Opportunity at
SGSSenior Manager: Incident Response
SGS is seeking a Senior Manager for Incident Response to lead CyberCom's investigative team as the primary hands-on investigator and manager. This position focuses on leading…
Career Tools
About This Role
SGS is seeking a Senior Manager for Incident Response to lead CyberCom's investigative team as the primary hands-on investigator and manager. This position focuses on leading high-severity security incidents—such as ransomware, cloud compromises, and insider threats—while overseeing daily team operations, case distribution, and staff development. Commercial targets and practice P&L are managed elsewhere, allowing this role to center entirely on technical leadership, evidence accuracy, methodology maintenance, and client engagement. The…
Job Description
SGS is seeking a Senior Manager for Incident Response to lead CyberCom's investigative team as the primary hands-on investigator and manager. This position focuses on leading high-severity security incidents—such as ransomware, cloud compromises, and insider threats—while overseeing daily team operations, case distribution, and staff development. Commercial targets and practice P&L are managed elsewhere, allowing this role to center entirely on technical leadership, evidence accuracy, methodology maintenance, and client engagement.
The role suits an experienced digital forensics and incident response professional who combines deep technical expertise with people management skills. Responsibilities include running complex forensic analyses, directing response workstreams, coaching junior staff, and interfacing with client executives, insurers, and legal counsel. Candidates must be prepared for unpredictable working conditions that may involve extended hours, weekends, on-call participation, and short-notice travel to client sites within South Africa and regionally.
Responsibilities
- Lead complex and high-severity investigations hands-on, including ransomware, business email compromise, cloud and identity compromise, and insider threat cases
- Direct and review host, memory, network, log, and cloud forensic analyses while establishing root cause and scope of data exposure
- Act as Incident Leader on major engagements to set investigative priorities, coordinate containment workstreams, and maintain decision logs
- Manage the incident response team directly by allocating cases, balancing workloads, and overseeing the on-call roster
- Coach and mentor responders through case reviews, peer analysis, and individual development plans
- Maintain incident response methodology, playbooks, and checklists aligned with NIST, ISO, and practice service catalogues
- Serve as the senior technical point of contact for clients, breach counsel, insurers, and law enforcement contacts
Requirements
- At least 10 years of experience in cyber security, with 7 or more years working hands-on in incident response, digital forensics, or cyber investigations
- Minimum of 3 years managing a technical team, encompassing case allocation, performance management, and staff development
- Track record as a lead investigator on ransomware and enterprise-wide compromises from initial triage to the final report
- Expert hands-on skill in Windows, Linux, and cloud forensics, memory analysis, log review, and EDR-led investigations
- Proficiency with standard forensic tools and analysis scripting languages like Python or PowerShell
- Working knowledge of the Protection of Personal Information Act, the Cybercrimes Act, and legal notification protocols in South Africa
- Ability to pass criminal record, credit, and qualification checks along with holding a valid driver's licence
Qualifications
- At least one senior incident response or forensics certification such as GIAC GCFA, GCIH, GCFE, GNFA, or equivalent
- Relevant degree or diploma in computer science, information security, digital forensics, or equivalent experience
- Advantageous credentials include GIAC GCIM, CREST CCIM, CISM, CISSP, or GREM
- Prior PCI Forensic Investigator experience or familiarity with delivering PCI forensic investigations
- Previous expert witness or court testimony experience in South Africa
- Experience with mobile forensics, malware analysis, reverse engineering, or operational technology incidents
Core Skills
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the employment type for this position?
The posting specifies a full-time employment type.
Is this role remote?
The posting does not specify remote or hybrid status, but notes that on-site attendance and travel within South Africa or regionally are required as engagements demand.
What salary is offered for this role?
The salary is not stated in the job posting.
What are the core experience requirements?
Candidates must have at least 10 years in cyber security, with 7 years hands-on in incident response or digital forensics, and at least 3 years managing a technical team.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.