Senior Director, Digital Forensics & Incident Response

About this role

About the Role:

The Senior Director, Digital Forensics & Incident Response owns AstraZeneca’s global capability to respond to and investigate cyber incidents. This role commands the enterprise response to material incidents across cloud, on-premises and OT/ICS environments; owns incident governance, readiness and the forensic defensibility of all collected evidence; and is accountable for executive reporting, lessons learned and the control hardening that follows.

This is a build role as AstraZeneca matures its internal incident response capability. The successful candidate will compose the function, hire the team and establish the standards under which it operates. The role leads through a Director, Forensics & Malware Analysis, and a global CSIRT working follow-the-sun alongside Regional Security Operations Centers in Macclesfield, Guadalajara, Chennai and Shanghai.

The role partners closely with Detection Engineering, Cyber Threat Intelligence, Threat Exposure Management, Insider Risk & DLP, IT, Legal, Privacy, Risk & Compliance, Corporate Communications, Insurance and Physical Security. Because AstraZeneca’s research and development intellectual property is a primary target for nation-state actors, and its manufacturing estate carries safety and supply consequences, the judgement exercised during an incident has consequences well beyond IT.

What You’ll Do: • Incident Command:   Act as the accountable commander for material and crisis-level cyber incidents, driving scoping, containment, eradication, recovery and investigation across hybrid cloud, on-premises and OT/ICS environments.

• Service Line Ownership:   Own the Incident Response strategy, multi-year roadmap, operating budget and capability plan, setting direction and standards with a high degree of autonomy.

• Incident Governance:   Define and maintain incident categories, severity definitions, activation criteria, decision authorities, delegation of authority during out-of-hours events and the handoff into enterprise crisis management.

• Forensic Defensibility:   Through the Director, Forensics & Malware Analysis, ensure that evidence is preserved, collected and analysed with chain-of-custody rigor that stands up to legal and regulatory scrutiny. Own the relationship with Legal regarding litigation hold, privilege and retention.

• Readiness and Exercises:   Run a calendar of tabletop, functional and purple-team exercises reaching from analyst level to the Executive Committee. Close findings and evidence improvement.

• Coverage Model:   Guarantee 24x7 response coverage with credible follow-the-sun handoffs, issue paths and surge capacity, including in-country arrangements where data-localisation or sanctions constraints apply.

• Automation and AI:   Operationalise agentic SIEM capability, XDR and SOAR playbooks, LLM-assisted runbooks and automated triage packages to compress mean time to detect, mean time to contain and mean time to respond without eroding evidentiary quality or human accountability.

• Metrics and Reporting:   Own Incident Response targets and key risk indicators, including mean time to detect, contain and respond, dwell time, containment quality and business impact. Report these credibly to senior leadership.

• Executive and Board Communication:   Deliver incident briefings, written updates and quarterly lessons-learned reviews to the CISO and IT leadership and, where warranted, the Audit Committee.

• Regulatory and Notification Support:   Work with Legal, Privacy and Compliance to support breach-notification assessments and regulatory obligations across the countries in which AstraZeneca operates, including material-incident disclosure considerations.

• Controls Hardening:   Drive post-incident detection and control improvements with Detection Engineering, Identity, Cloud, Endpoint, Network and OT teams.

Leading the Function: • Build and Organization Design:   Design and staff the DFIR function from a near-zero baseline, defining roles, levels, sourcing locations and the balance of permanent and retained capacity.

• Leading Through Leaders:   Manage a Director-level leader and incident managers; set objectives, review performance and develop successors capable of commanding an incident in the Senior Director’s absence.

• Coverage and On-Call:   Maintain on-call rotations, surge models and cross-regional handoff standards, and act as the senior critical issue point when severity demands it.

• Talent and Capability:   Lead inclusive recruitment and build genuine career paths and upskilling in DFIR, cloud and identity forensics, OT/ICS, malware analysis and automation, using regional and external partnerships.

• Team Sustainability:   Protect the team from the burnout that can follow sustained high-tempo response. Design rotations, recovery and workload distribution deliberately.

• Budget and Commercial Management:   Own the service line budget, tooling and retainer spend, and build the case for further investment.

Knowledge, Experience and Understanding: • Incident Command and the Incident Response Lifecycle:   Proven command across the full lifecycle at enterprise scale, including preparation, detection, scoping, containment, eradication, recovery and post-incident review, supported by appropriate plans and playbooks.

• Digital Forensics and Evidence Handling:   Experience managing the collection, preservation and analysis of digital evidence; chain of custody; timeline reconstruction; attribution; and concise executive reporting of forensic findings.

• Attacker Tradecraft:   Deep working knowledge of the attack lifecycle and MITRE ATT&CK, common threat actor tactics, techniques and procedures, and the different behaviours of nation-state and ransomware operators once inside an environment.

• Automation and AI in Operations:   Experience operationalising modern security tooling, including SIEM, SOAR and XDR, together with artificial intelligence, large language model and agentic capabil

Similar jobs

• Sr. Cyber Analyst, Digital Forensics Incident Response — Atbayjobs · Remote
• Principal/Digital Forensics, Incident Response & Cybersecurity (Forensic Services practice) — Charlesriverassociates · Boston, MA, United States; Chicago, IL, United States; Dallas, Texas, United States; Houston, Texas, United States; New York, NY, United States; Washington, DC, United States
• Senior Investigations Analyst – Digital Forensics — Corebridgefinancial · TX-Houston | NJ-Jersey City
• Cyber Analyst, Digital Forensics Incident Response — Atbayjobs · Remote
• Senior Associate/Cybersecurity & Incident Response (Forensic Services practice) — Charlesriverassociates · Boston, MA, United States; Chicago, IL, United States; Dallas, Texas, United States; Houston, Texas, United States; Washington, DC, United States
• Associate Principal/Cybersecurity & Incident Response (Forensic Services practice) — Charlesriverassociates · Boston, MA, United States; Chicago, IL, United States; Dallas, Texas, United States; Houston, Texas, United States; Washington, DC, United States
• Global Director of Autonomous Incident Response and Forensic Analysis — MUFG · Jersey City, NJ | Tempe, AZ
• Sr. Director, Cyber Threat Detection & Response — McKesson · Richmond, VA