Senior Manager - DSO - UK Data Incident Investigations Lead

Location: London, Manchester or Scotland

At EY, we are committed to building a better working world. EY is looking to strengthen its enterprise data incident handling and investigation capability to improve consistency, speed and governance in suspected data incident triage and investigation. Join us and be part of a global team of over 13,000 professionals dedicated to delivering cutting-edge security transformation programs and services.

The opportunity: As a senior manager, you will perform the operational delivery of the Data Incident & Investigation capability, running day-to-day triage, investigation coordination, and escalation across the incident lifecycle. You will ensure consistent execution with defined pathways and drive disciplined delivery against agreed standards while feeding operational insight and improvement opportunities into the ongoing evolution of the capability.

Key Responsibilities:

• Receive, manage, and investigate referrals of suspected data incidents from defined entry points and ensure required information is captured consistently in the incident management system.
• Log and track suspected incidents and maintain triage workflow discipline across multiple concurrent incidents.
• Conduct assessments, interviews, and investigations for data incidents to inform escalation decisions and downstream investigation.
• Maintain open and proactive operational communication with key stakeholder groups including Data Protection, Forensic, Talent, and Infosec teams with defined escalation pathways to drive structured collaboration through the early incident lifecycle.
• Produce and maintain standard incident reporting MI (volume, severity, trends, response timelines) and ensure high documentation quality and consistency.
• Ensure timely escalation of incidents in line with defined thresholds and escalation criteria.
• Maintain audit ready documentation and ensure complete traceability of triage decisions, evidence and handoffs.
• Identifying and mitigating potential security risks and communicate solutions back to project teams.
• Providing advice to the business on good information governance and participating in training and awareness programs.
• Ensuring internal policies are maintained and available, and risk assessments are conducted.

Skills and Attributes for success:

• A strong foundational understanding of information security principles is essential.
• Comfortable working with key IT platforms such as Microsoft 365.
• Proficient in reviewing and analysing security-related data, potentially including event logs, authentication logs and other relevant information.
• Ability to assess and interpret security data effectively to identify potential threats and vulnerabilities, triage and resolve incidents and advise management with actionable intelligence.
• Professional demeanour with the ability to establish credibility and demonstrate expertise quickly.
• Strong incident coordination capability: confident working under pressure and driving disciplined follow-ups across stakeholders.
• Strong team player that encourages open communication amongst team members.
• Stakeholder management skills across technical and non-technical audiences.
• Strong attention to detail and operational rigour to maintain reporting quality, auditability and consistency.

To qualify for the role, you must have:

• Professional experience delivering triage, incident management or comparable risk-based workflow delivery.
• Experience interviewing insider risk actors, witnesses and impacted individuals across both digital and human domains.
• An incident investigation professional training or certification, e.g., GIAC Incident Handler.
• Expertise in producing structured reporting/MI outputs and maintaining disciplined documentation standards.
• Experience of working in a professional services firm or partnership would be beneficial.
• A passion for security and technology and identifying and solving problems.
• Motivation, commitment and the desire to continue to learn and develop.

Please note: The successful candidate must undergo and pass checks in line with SC (Security Check) clearance standards after joining EY. These checks may include, but are not limited to, verification of identity, right to work in the UK, employment history, proof of address may be required and unspent criminal convictions. Candidates must be a UK national or have been a resident in the UK for a minimum of five years and ensure that they have not spent more than six months outside the UK.

Join Us: At EY, you’ll have the chance to build a meaningful and fulfilling career, supported by an inclusive culture and cutting-edge technology. Together, we can create a better working world for all.

What we look for: We’re interested in people with integrity who can collaborate with people from a diverse range of backgrounds and crucially a growth mindset.

What we offer: We offer a competitive remuneration package where you’ll be rewarded for your individual and team performance. Our comprehensive Total Rewards package includes support for flexible working and career development, and with FlexEY you can select benefits that suit your needs, covering holidays, health and well-being, insurance, savings and a wide range of discounts, offers and promotions.

Plus we offer:

• Success as defined by you: The opportunity to help build and shape a new UK&I Incident & Investigations capability focused on improving consistency, speed and governance in suspected data incident triage.
• Transformative leadership: We’ll give you the insights, coaching and confidence to be the leader the world needs.
• Continuous learning: You’ll develop the mindset and skills to navigate whatever comes next.
• Diverse and inclusive culture: You’ll be embraced for who you are and empowered to use your voice to help others find theirs.

If you can demonstrate the skills described above and are excited to operate at the centre of a high impact Risk Management capability, we encourage you to apply.