Cyber Response and Recovery Manager

£75,000 - £85,000 GBP
Hybrid WORKING
Location: Manchester, Central London, Greater London - United Kingdom Type: Permanent
We are seeking an experienced Cyber Response & Recovery Manager to join a specialist Cyber Response Services team, supporting clients through some of their most complex and critical cyber incidents.
This role focuses on the recovery and remediation phase following major cyber incidents, helping organisations restore critical services, rebuild compromised environments, remove attacker persistence, and strengthen their long-term cyber resilience.
You will work alongside incident response teams, forensic specialists, technology teams, senior stakeholders and client leadership to translate incident findings into practical recovery and remediation plans.
The Role
This is a hands-on cyber recovery role, rather than a traditional incident response position. You will support clients during the most operationally critical stages of a cyber incident, helping them safely recover and improve their security foundations.
Key responsibilities include:

• Leading cyber recovery and remediation workstreams during major incidents.
• Supporting recovery from incidents including ransomware, destructive malware, Active Directory compromise, cloud compromise and advanced network intrusions.
• Delivering hands-on remediation across enterprise environments including Windows, Linux, Active Directory, cloud and network infrastructure.
• Removing attacker persistence and restoring trust across compromised environments.
• Supporting identity recovery, infrastructure rebuilds, patching and vulnerability remediation.
• Reviewing and improving network architecture, segmentation and security controls to reduce future risk.
• Designing secure recovery approaches including isolated recovery environments, backup validation and restoration strategies.
• Developing phased recovery plans covering immediate stabilisation, remediation and long-term security improvements.
• Managing stakeholders across technical teams, executives, legal advisers, insurers and incident response teams.

Essential Experience
The successful candidate will have:

• Active SC Clearance.
• Strong experience across cyber security, incident response and recovery.
• Hands-on infrastructure and systems administration experience.
• Experience supporting cyber incident recovery activities, including ransomware, network intrusions or compromised environments.
• Strong technical knowledge of:
• Active Directory
• Windows Server
• Linux
• Enterprise networking
• Cloud environments (Azure/AWS/M365)
• Experience leading technical workstreams during high-pressure incidents.
• Ability to translate technical findings into clear remediation plans and business-focused recommendations.
• Strong stakeholder management and communication skills.

Desirable Experience
Experience in the following areas would be beneficial:

• Active Directory recovery and hardening.
• Identity security and privileged access management.
• Secure system rebuilds and restoration of critical services.
• Network segmentation and firewall architecture.
• Backup recovery strategies and resilience planning.
• Cyber recovery roadmaps and remediation programmes.
• Managing complex client engagements and mentoring junior team members.

If you think this role is a strong fit, we'd love to hear from you.