Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 8 hours ago

Senior Manager: Incident Response

SGS4,616 open roles

Where
Centurion, GP, South Africa
Work mode
On site
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSenior Manager: Incident ResponseSGS · Centurion, GP, South Africa

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on SGS's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.9% of postings close within 7 days. Measured by our own scanner across the market. SGS postings stay open a median of 43 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.7%3 days
  3. 13.9%7 days
  4. 22.4%14 days
  5. 38.1%30 days
  6. 59.0%60 days
This job: posted 8 hours ago

SGS median: 43 days open

The posting

Company Description

SGS is the world’s leading inspection, verification, testing and certification company. SGS is recognized as the global benchmark for quality and integrity. With more than 97,000 employees, SGS operates a network of over 2,600 offices and laboratories around the world.

Job Description

Purpose of the role

To lead CyberCom's incident response investigations as the most senior hands-on investigator in the team, and to manage the IR team day to day. The role leads complex investigations personally, directs and reviews the work of other responders, and is accountable for the accuracy, defensibility and timeliness of every investigation the team delivers. It is a people- and quality-focused management role; commercial targets and practice P&L sit elsewhere.

Key responsibilities

1. Senior investigation and incident leadership

  • Lead complex and high-severity investigations hands-on: ransomware and double extortion, business email compromise, cloud and identity compromise, insider threat and data theft.
  • Carry out and direct host, memory, network, log and cloud forensic analysis, reconstruct attacker timelines and establish root cause, scope of access and data exposure.
  • Act as Incident Leader on major engagements: set investigative priorities, coordinate containment and recovery workstreams, and keep a defensible decision log.
  • Formulate and test investigative hypotheses, and make sure conclusions are supported by evidence and clearly separated from assumptions.
  • Support with briefing of client executives, breach counsel and insurers on findings in plain language, without overstating what the evidence shows.
  • Write and review investigation reports, executive summaries and findings; sign off all reports before release.

2. Team management

  • Manage the IR team directly: allocate cases, set priorities, track progress and balance workloads across active investigations.
  • Run the on-call roster and escalation process, and approve leave, overtime and time off in lieu after major incidents.
  • Conduct regular one-on-ones, set objectives, run performance reviews and manage underperformance in line with HR policy.
  • Coach and mentor responders through case reviews and peer analysis, and own individual development and certification plans.
  • Take part in recruitment, onboarding and induction of new team members, and build a succession bench for senior roles.
  • Monitor team wellbeing and fatigue during long incidents, and keep on-call sustainable.
  • Report on team activity, case status and resourcing to [Head of Operations / MD].

3. Methodology, quality and tooling

  • Maintain the IR methodology, playbooks and checklists in line with NIST SP 800-61 Rev. 3, ISO/IEC 27035 and the practice's 17-service catalogue.
  • Ensure evidence handling and chain of custody meet ISO/IEC 27037 and court standards, working with the Cyanre lab on acquisitions and analysis.
  • Run post-incident reviews internally and with clients, and feed lessons into playbooks, detections and threat-hunting hypotheses.
  • Evaluate and govern the IR tool stack (EDR, forensic suites, log platforms, SOAR) and keep the team current on attacker TTPs (MITRE ATT&CK).
  • Support the group's ISO 27001 programme and any IR accreditations the group pursues (e.g. CREST CSIR).

4. Client engagement

  • Serve as the senior technical point of contact for clients during investigations.
  • Give sales and account management technical input on scoping, effort estimates and statements of work.
  • Build working relationships with breach counsel, insurers and law enforcement contacts.

5. Legal, regulatory and expert work

  • Prepare affidavits and expert reports, and testify where engagements move to litigation or criminal proceedings, with handoff to Lextrado EDS for litigation support.
  • Make sure work under legal privilege is set up and documented correctly from the outset.

Key performance indicators

  • Quality of investigations: findings that hold up to peer, client and legal review, and QA defects found after release.
  • Time to engage on retainer incidents against contracted SLAs.
  • Report turnaround time against agreed deadlines.
  • Client satisfaction with investigations led or supervised.
  • Team retention, performance review completion, certification progress and succession readiness.
  • Playbook and methodology updates delivered from post-incident reviews.

Qualifications

Minimum requirements

  • 10+ years in cyber security, with at least 7 years hands-on in incident response, digital forensics or cyber investigations.
  • At least 3 years managing a technical team, including case allocation, performance management and staff development.
  • A track record as lead investigator on ransomware and enterprise-wide compromises, from initial triage through root cause and final report.
  • Expert, hands-on skill in Windows, Linux and cloud forensics (Microsoft 365/Entra ID, Azure, AWS), memory analysis, log and timeline analysis, and EDR-led investigations.
  • Proficiency with standard forensic tooling (e.g. Magnet AXIOM, EnCase, X-Ways, Velociraptor, KAPE, Volatility) and scripting for analysis (Python or PowerShell).
  • Rigorous evidence handling, chain of custody and report writing that holds up to legal scrutiny.
  • Working knowledge of POPIA, the Cybercrimes Act and how notification and privilege work in South Africa.
  • At least one senior IR or forensics certification: GIAC GCFA, GCIH, GCFE, GNFA or equivalent.
  • Relevant degree or diploma in computer science, information security or digital forensics, or equivalent experience.
  • Able to pass criminal record, credit and qualification checks; valid driver's licence and willingness to travel to client sites at short notice.

Advantageous

  • GIAC GCIM (SANS LDR553), CREST CCIM, CISM or CISSP.
  • PCI Forensic Investigator (PFI) experience, or experience delivering PCI forensic investigations.
  • Prior expert witness or court testimony experience in South Africa.
  • Malware analysis or reverse engineering (e.g. GREM).
  • Mobile forensics experience (e.g. Cellebrite).
  • Experience working on insurer or breach-counsel panels.
  • Exposure to OT/ICS incidents or AI-related security incidents.

Additional Information

Competencies

  • Investigative rigour: follows the evidence, tests alternative explanations and states the limits of what is known.
  • Calm command: makes clear decisions on incomplete information and keeps a team and a client steady through long incidents.
  • Communication: turns technical findings into business risk for executives, lawyers and insurers, in speech and writing.
  • Integrity and defensibility: documents decisions, and doesn't overstate findings.
  • People management: sets clear expectations, gives direct feedback, develops responders and holds standards without burning the team out.

Working conditions

  • Incident work is unpredictable: extended hours, weekends and on-site attendance during major incidents are part of the role.
  • On-call participation and escalation oversight, with time off in lieu after major engagements.
  • Travel within South Africa, and occasionally regionally, as engagements require.
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against SGS's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on SGS's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    SGS's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.