At a Glance
- Tasks: Lead the response to complex cyber security incidents and enhance incident management capabilities.
- Company: Join WTW, a global leader in information and cyber security.
- Benefits: Enjoy 25 days annual leave, private healthcare, and a pension scheme with matched contributions.
- Other info: Hybrid working model with opportunities for global travel and career growth.
- Why this job: Make a real impact in cyber security while working with cutting-edge technology.
- Qualifications: Experience in SOC or incident response and strong understanding of cybersecurity principles required.
The Associate Manager - Cyber Security Incident Response will play a pivotal role within WTW’s Global Information and Cyber Security Defence (ICSD) function, leading the response to complex security incidents and driving initiatives to enhance WTW’s Cyber incident management capabilities. This mid senior-level role requires a highly experienced professional with strong expertise in incident response and cybersecurity. The individual will work as part of a global, multi-disciplined security community with strong support across the business, contributing to fostering a security-aware culture while ensuring WTW remains a great place to work. With WTW’s large global footprint, this role offers a fascinating range of work, and occasional global travel may be required.
The individual will work as part of a global, multi-disciplined security community with strong support across the business, contributing to fostering a security-aware culture while ensuring WTW remains a great place to work. With WTW’s large global footprint, this role offers a fascinating range of work, and occasional global travel may be required.
This role is based in London and follows a hybrid working model, with a minimum requirement of three days per month in the office. Applications are also welcome from candidates based elsewhere in the UK; however, travel to the London office will be required as and when needed to meet business demands.
The Role:
The Associate Manager - Cyber Security Incident Response will play a key role in managing and responding to security incidents within WTW’s Global Cyber Security Incident Response Team. Responsibilities of this role will include:
- Serve as the primary lead for significant security incidents, coordinating response efforts across technical and business teams to minimize impact and ensure timely resolution.
- Establish, refine, and maintain incident response processes, playbooks, and workflows to align with industry best practices and WTW’s organizational needs.
- Act as the central point of contact for incident response activities, ensuring effective communication with internal and external stakeholders, including senior leadership, Legal, HR, and Compliance teams.
- Leverage AI and automation to accelerate incident containment, response, and remediation — embedding AI-assisted triage, alert enrichment, and decision support into SOAR playbooks and response workflows
- Lead the in-depth technical investigation of security incidents escalated from the SOC, ensuring timely containment, eradication, and recovery while identifying root causes and potential impact.
- Adept at leading global response teams, integrating SIEM/SOAR platforms, and collaborating with MSSPs to mitigate cloud-native and supply chain attack.
- Work closely with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability Management teams to ensure seamless coordination and information sharing during incidents.
- Lead root cause analysis and post-incident reviews to identify gaps, implement lessons learned, and enhance the overall incident response program.
- Evaluate and prioritize incidents based on potential impact and severity, escalating issues to higher levels of management or other teams as required.
- Contribute to the development and maintenance of key performance indicators (KPIs) and metrics to measure the effectiveness of incident response processes.
- Act as a liaison between technical teams and business stakeholders, ensuring clear communication during incidents and status updates.
Qualifications
What you'll bring:
We are looking for a candidate for Cyber Security Incident Response who has the following:
- Strong work experience in SOC or incident response, with a strong understanding of cybersecurity principles, frameworks, and tools.
- Understanding of AI/ML applications in security operations, including AI-augmented detection, triage, and response automation.
- Awareness of AI-specific threats and incident types (prompt injection, model/data poisoning, sensitive-data exposure via GenAI), and familiarity with OWASP LLM Top 10 / MITRE ATLAS.
- Hands-on cloud incident response across Azure, AWS, and/or GCP, including cloud-native log sources (Azure Activity/Entra ID sign-in logs, AWS CloudTrail) and the reality that cloud IR differs from on-prem.
- Proven ability to lead high-stakes security incidents and coordinate cross-functional teams effectively.
- Deep understanding of MITRE ATT&CK, cyber kill chain, and incident response methodologies.
- Exceptional verbal and written communication skills, with the ability to convey complex technical concepts to non-technical audiences, including executives.
- A proactive and decisive mindset with the ability to operate under pressure.
- Strong analytical and problem-solving skills to make informed decisions in complex situations.
- Collaborative and adaptable, with a passion for mentoring and developing team members.
What we offer:
Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.
We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.
Equal Opportunity Employer
We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidatehelpdesk@wtwco.com
Associate Manager - Cyber Security Incident Response in London employer: WTW
WTW is an exceptional employer that fosters a dynamic work culture, offering a hybrid work model that promotes flexibility and work-life balance. Employees benefit from comprehensive health insurance and have ample opportunities for professional growth within the M&A team, making it an ideal environment for those looking to thrive in a collaborative and innovative setting.
StudySmarter Expert Advice🤫
We think this is how you could land Associate Manager - Cyber Security Incident Response in London
✨Get Involved in the Cybersecurity Community
Diving into the cybersecurity community is key for landing that full-time gig. Join forums like Reddit's r/cybersecurity or attend local meetups to connect with industry veterans and other job seekers. Networking is everything in this field—don’t just be a passive lurker!
✨Show Off Your Skills with Capture the Flag Competitions
Participate in Capture the Flag (CTF) competitions; these are not just a fun way to boost your skills but also a chance to showcase your talent to potential employers. Many companies, including WTW, love seeing candidates who actively engage in these challenges.
✨Tailor Your Online Presence
Make sure your LinkedIn and any professional profiles reflect your cybersecurity expertise. Share your projects, whether they’re personal or from a previous role, to catch the eye of hiring managers. This is how they’ll find your passion and commitment to the field!
✨Apply Directly Through WTW
Don’t forget to head straight to our website and check out any openings for cybersecurity roles at WTW. Applying directly can sometimes give you an edge, especially if you can mention that you've been following our work or engaging in the community.
We think you need these skills to ace Associate Manager - Cyber Security Incident Response in London
Some tips for your application 🫡
Show off your technical skills:In cybersecurity, it's crucial to highlight your technical prowess. Make sure your CV showcases specific skills like network security, penetration testing, or threat analysis. If you have relevant certifications (like CEH or CISSP), pop those on the front page to grab attention!
Tailor your portfolio for the role:Even for a full-time role, a portfolio can set you apart. If you've worked on any cybersecurity projects—be it CTF challenges, security assessments, or research papers—include these in your application. This demonstrates not just your skills, but also your hands-on experience!
Use real-world examples:When writing your cover letter, don’t just stick to your qualifications. Share real-world examples of how you’ve tackled security issues or vulnerabilities. This gives the hiring team at WTW insight into your practical problem-solving abilities and makes your application memorable.
Demonstrate your passion for cybersecurity:Cybersecurity is an ever-evolving field, so show us that you’re always learning! Mention any recent courses, webinars, or industry events you’ve attended. This not only exhibits your enthusiasm but also signals to WTW that you’re committed to staying ahead in the game.
How to prepare for a job interview at WTW
✨Sharpen Your Technical Skills
For a role in cybersecurity, it’s essential to be up-to-date with the latest tools and techniques. Brush up on your knowledge of firewalls, intrusion detection systems, and vulnerability assessment tools. Be ready to discuss specific scenarios where you’ve applied these skills, as hands-on experience can really set us apart in interviews.
✨Prepare for Scenario-Based Questions
Expect the interviewers at WTW to throw in some hypothetical situations to see how you’d handle them. Think about common security breaches or incidents and be prepared to explain how you would respond. This not only shows your problem-solving skills but also your understanding of real-world cybersecurity challenges.
✨Highlight Your Certifications
Certifications like CompTIA Security+, CISSP, or CEH can give you a significant edge in a full-time role in cybersecurity. Make sure to mention these during your interview and be prepared to discuss what you learned through those certifications and how they relate to the position at WTW.
✨Show Your Passion for Cybersecurity
Since you’re going for a full-time gig, showing genuine enthusiasm for the field can make all the difference. Share any personal projects, blogs, or communities you’re part of that relate to cybersecurity. This not only showcases your passion but also your commitment to staying engaged in this ever-evolving field.
