Cyber Defense Incident Responder

EY is looking for a Cyber Defense Incident Responder to join its global Information Security organisation. The firm delivers technology‑driven services to clients worldwide and relies on secure systems for everyday work across more than 140 countries. The role sits within the Cyber & Investigative Services team, which protects EY's data and client information from cyber threats. The day‑to‑day work centres on organising the reaction to security breaches that originate from external actors, often outside normal business hours. The incumbent will act as the main point of contact between internal business units, other InfoSec groups, external vendors and legal, data‑privacy and risk‑management partners. They will align the incident handling process with other corporate response programmes, create and refine documentation, and work with the Cyber Incident Response lead to assess team performance and launch corrective actions. Preparing timely updates for senior leadership, maintaining internal playbooks and knowledge bases, and participating in an on‑call rotation are also required. Candidates must hold a bachelor's or master's degree in Computer Science, Information Systems, Engineering or a comparable discipline, or possess equivalent professional experience. At least seven years of professional background in two or more of the following areas is required: Security Operations Centre analysis or management (minimum three years), cyber‑incident coordination, threat‑intelligence work, detection engineering, active‑defence penetration testing, or forensic e‑discovery. A solid grasp of security threats, vulnerabilities and the full incident‑response lifecycle is essential, as is practical experience with electronic investigation tools, log correlation, data handling and forensic techniques. Additional qualities that will help the individual succeed include a broad understanding of all information‑security domains, the capacity to make sound judgments amid uncertainty, and strong emotional resilience. The team values integrity, curiosity, and the ability to balance professional duties with personal commitments while maintaining composure under pressure. What the role asks for: - Bachelor's or Master's in Computer Science, Information Systems, Engineering or equivalent - Minimum seven years experience in relevant cyber‑defence roles - At least three years as SOC Analyst or Manager - Deep knowledge of security threats, vulnerabilities and incident response - Proficiency with forensic tools, log analysis and electronic data handling - Required on‑call rotation for off‑hours incident response - Nice‑to‑have: broad Information Security domain expertise - Nice‑to‑have: emotional intelligence and calm under pressure