Cyber Incident Response Consultant in Southampton

Contract: Six Months (possibility of extension)

Location: Basingstoke (X3 days onsite; X2 working remote)

Role Overview

We are seeking an experienced Cyber Incident Response Consultant to support our cybersecurity function on a contract basis. The consultant will be responsible for collaborating with organisation stakeholders in developing, updating, and enhancing a comprehensive set of tactical and operational cyber incident response documents, including the Incident Response Plan, Communication Plan, Incident Response Playbooks, and Containment & Eradication procedures. This engagement is focused on delivering high-quality, actionable documentation and strengthening the organisation's overall incident response capability. The consultant will work closely with internal stakeholders to ensure alignment with business operations, technology, and regulatory requirements.

• IR Technical Capability Maturity Assessment
• Evaluate and report on the organisation's technical capabilities and maturity against IR Detection & Analysis, Containment, Eradication, & Recovery domains using industry maturity model.
• Develop and Maintain Incident Response Documentation
• Produce and refine the organisation's Incident Response Plan (IRP).
• Build clear and consistent internal and external incident communication workflows.
• Develop detailed incident response playbooks, such as ransomware, business email compromise (BEC), data breach, insider threat, malware outbreak, DDoS attack, cloud service compromise. (Final scenarios to be agreed during discovery.)
• Strengthen Organisational Incident Preparedness
• Conduct discovery sessions with technical and non-technical stakeholders.
• Review existing security processes, tools, and architecture to ensure documentation reflects current environments.
• Support tabletop exercise planning and incorporate lessons learned into documentation.
• Provide expert guidance and recommendations to improve cyber readiness.
• Build Containment & Eradication Frameworks
• Develop clear, structured containment strategies for different incident types.
• Create eradication and recovery guidance aligned with operational capabilities.
• Ensure all procedures support legal, compliance, and evidence-preservation requirements.
• Align with Standards & Regulatory Expectations
• Ensure all documentation aligns with CIS Controls.
• Ensure materials support relevant legal and regulatory expectations as appropriate for the organisation.
• Collaborate Across the Business
• Work closely with SOC staff, IT teams, legal, risk, compliance, communications, and senior leadership.
• Convert technical details and threat intelligence into clear, actionable steps appropriate for operational use.

Required Experience & Skills

• Proven experience (typically 5+ years) in incident response, SOC operations, cybersecurity consulting, or GRC.
• Demonstrated ability to produce high-quality IR documentation and playbooks for medium-to-large organisations.
• Deep understanding of modern threat actors, attack methodologies, and incident response lifecycle.
• Experience across cloud (Azure, AWS) and on-premise enterprise environments.
• Exceptional written communication skills and ability to deliver polished, structured documentation.
• Ability to work independently, meet deadlines, and drive deliverables with minimal supervision.

Preferred Qualifications and Experience

• GCIH, GCFA, CISSP, or equivalent security certifications.
• Experience working within regulated sectors (financial services, healthcare, government, critical infrastructure).
• Prior participation in or leadership of real-world cyber incident response activities.
• Familiarity with identity governance, EDR platforms, SIEM tooling, and cloud security architecture.

Why This Engagement Matters

The Cyber Incident Response Preparation Consultant plays a crucial role in elevating the organisation's cyber maturity and readiness. Through the development of robust documentation and playbooks, the consultant will help ensure the organisation can respond rapidly, effectively, and consistently to modern cyber threats.