Location
London, UK (Hybrid working model with a minimum of three days per month in the office). Applications from candidates elsewhere in the UK are welcome; travel to the London office will be required as needed.

Hours
Full Time

Salary
Negotiable

About the Role
The Associate Manager - Cyber Security Incident Response will play a pivotal role within WTW’s Global Information and Cyber Security Defence (ICSD) function, leading the response to complex security incidents and driving initiatives to enhance WTW’s cyber incident management capabilities. This mid senior-level role requires a highly experienced professional with strong expertise in incident response and cybersecurity. You will work as part of a global, multi-disciplined security community with strong support across the business, contributing to fostering a security-aware culture while ensuring WTW remains a great place to work. The role offers a fascinating range of work across WTW’s large global footprint, with occasional global travel required.

The key responsibilities include serving as the primary lead for significant security incidents, coordinating response efforts across technical and business teams to minimize impact and ensure timely resolution. You will establish, refine, and maintain incident response processes, playbooks, and workflows aligned with industry best practices and organizational needs. Acting as the central point of contact for incident response activities, you will ensure effective communication with internal and external stakeholders including senior leadership, Legal, HR, and Compliance teams.

You will leverage AI and automation to accelerate incident containment, response, and remediation by embedding AI-assisted triage, alert enrichment, and decision support into SOAR playbooks and response workflows. Leading in-depth technical investigations of security incidents escalated from the SOC, you will ensure timely containment, eradication, and recovery while identifying root causes and potential impact.

The role requires adeptness at leading global response teams, integrating SIEM/SOAR platforms, and collaborating with MSSPs to mitigate cloud-native and supply chain attacks. You will work closely with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability Management teams to ensure seamless coordination and information sharing during incidents. Additionally, you will lead root cause analysis and post-incident reviews to identify gaps, implement lessons learned, and enhance the overall incident response program.

You will evaluate and prioritize incidents based on potential impact and severity, escalating issues as required. The role also involves contributing to the development and maintenance of KPIs and metrics to measure the effectiveness of incident response processes and acting as a liaison between technical teams and business stakeholders to ensure clear communication during incidents and status updates.

Experience
- Strong work experience in SOC or incident response with a solid understanding of cybersecurity principles, frameworks, and tools.
- Hands-on cloud incident response experience across Azure, AWS, and/or GCP, including cloud-native log sources such as Azure Activity/Entra ID sign-in logs and AWS CloudTrail.
- Proven ability to lead high-stakes security incidents and coordinate cross-functional teams effectively.
- Deep understanding of MITRE ATT&CK, cyber kill chain, and incident response methodologies.
- Experience leveraging AI/ML applications in security operations, including AI-augmented detection, triage, and response automation.
- Awareness of AI-specific threats and incident types (e.g., prompt injection, model/data poisoning, sensitive-data exposure via GenAI) and familiarity with OWASP LLM Top 10 / MITRE ATLAS.

About you
- Exceptional verbal and written communication skills, able to convey complex technical concepts to non-technical audiences including executives.
- Proactive and decisive mindset with the ability to operate under pressure.
- Strong analytical and problem-solving skills to make informed decisions in complex situations.
- Collaborative and adaptable, with a passion for mentoring and developing team members.

Qualifications
- Relevant cybersecurity certifications and/or equivalent professional experience are preferred but not explicitly required.
- Demonstrated knowledge of incident response best practices and security operations technologies.