Cyber Incident Exercising Team Lead (NCSC CIE Scheme), Associate

Intelance is a UK advisory and assurance firm building a formal Cyber Incident Exercising service aligned with the NCSC CIE Technical Standard. We are appointing an experienced Team Lead as an associate contractor to lead the design, delivery and assurance of organisationally significant tabletop and live play exercises for UK clients.

This is an associate panel role. Assignments will be agreed separately through a clear scope, timetable and day rate. The role includes remote design work, facilitated sessions and travel to client sites across the UK.

Tasks

• Lead the complete Design, Develop, Conduct and Evaluate life cycle for cyber incident exercises.
• Scope exercises with clients and agree objectives, participants, assumptions, dependencies, safety controls and success measures.
• Design credible threat led scenarios using current threat intelligence, relevant tactics, techniques and procedures and frameworks such as MITRE ATT&CK.
• Lead both tabletop and live play exercises for organisationally significant cyber incidents.
• Develop injects, timelines, participant materials, exercise control plans, observation records and communications.
• Facilitate exercises for Board, management and operational participants.
• Direct the exercise control function, manage pace and adapt delivery safely in response to player actions.
• Coordinate technical, legal, regulatory, communications and business continuity stakeholders.
• Lead debriefs, identify clear lessons and produce concise reports with practical actions.
• Maintain client case studies, references, feedback and scheme evidence.
• Coach other Intelance facilitators and help maintain a defined, repeatable CIE delivery method.
• Apply relevant UK incident reporting and escalation knowledge, including the NCSC, law enforcement, Action Fraud and the Information Commissioner's Office.

Requirements

Essential

• At least three years of experience delivering cyber incident exercises for external clients where exercising formed a key part of the role, or evidence of having passed the IASME CIE Team Lead test.
• Direct experience of both tabletop and live play exercises for organisationally significant incidents.
• Delivery experience at two or more levels: Board, management and operational.
• Physically based in the UK and able to travel to client locations.
• Proven experience leading exercise scoping, scenario development, inject design, exercise control, facilitation, debriefing and reporting.
• Strong knowledge of cyber incident response plans, incident management, business continuity and crisis communications.
• Able to use threat intelligence and real world tactics, techniques and procedures to build credible scenarios.
• Working knowledge of UK cyber incident reporting, law enforcement, Action Fraud, the Information Commissioner's Office and relevant legal or regulatory duties.
• Able to provide client case studies, sample outputs and references. Anonymised material is acceptable initially.
• Strong written and spoken communication across technical and senior business audiences.
• Clear understanding of safe exercise delivery, confidentiality and conflicts of interest.

Desirable

• Previous work against the NCSC CIE Technical Standard.
• NCSC Exercise in a Box, NIST SP 800 84 or equivalent exercise methodology experience.
• Experience in regulated industries, public sector, critical infrastructure or complex supply chains.
• Incident response, crisis management, threat intelligence or digital forensics qualifications.
• Experience building or leading a repeatable cyber exercising service.

Benefits

• Take a leading role in building Intelance's NCSC aligned Cyber Incident Exercising capability.
• Lead clearly scoped UK client exercises with senior stakeholder access.
• Flexible project based associate work with remote design and agreed client site delivery.
• A written scope, timetable and agreed day rate before each assignment.
• Support from Intelance's wider cyber assurance, architecture, ISO and governance team.
• Access to structured delivery templates, secure collaboration and quality controls.
• Opportunity to shape the service method, exercise library and facilitator capability.

Shortlisted candidates will be asked for evidence and references. Anonymised case studies and redacted sample outputs are sufficient at application stage. Do not send confidential client material.