Head of Security Incident Management

The role

Lead and mature WPP's global Security Incident Management capability across the full incident response lifecycle. Own the function and its people, and act as senior escalation authority for Sev1 and Sev2 security incidents.

What you will do

• Own the end-to-end Security Incident Management capability across WPP.
• Lead and develop Security Incident Management Leads, Senior Security Incident Responders, and Security Incident Responders.
• Set the strategic direction for incident response, aligned to Operational Security objectives and the ASO roadmap.
• Act as senior escalation authority for Sev1 and Sev2 security incidents.
• Provide executive-level updates during significant cyber security incidents and crisis situations.
• Lead the transformation of Security Incident Management into an automation-first capability aligned to ASO principles.
• Lead strategic coordination during major cyber incidents, ransomware events, breaches and regulatory incidents.
• Own Security Incident Management policies, standards, procedures, playbooks and operating documentation.
• Oversee Root Cause Analysis and Post Incident Review programmes.
• Define and own Security Incident Management KPIs, KRIs, SLAs and operational metrics.

Required qualifications

• Extensive experience leading enterprise-scale Security Incident Management or Incident Response functions.
• Demonstrable experience directing major cyber security incidents and crisis response activities.
• Strong understanding of modern incident response methodologies, operating models and governance frameworks.
• Experience leading multidisciplinary cyber security teams in large, global organisations.
• Deep technical understanding of SIEM, SOAR, EDR/XDR, cloud security, identity security, email security and digital forensics.
• Experience defining operational metrics, service management frameworks and continual improvement programmes.
• Ability to communicate effectively with technical teams, executives, legal teams, regulators, clients and external stakeholders.
• Proven experience building and maturing operational security capabilities.

Nice to have

• Experience implementing automation-first or Autonomic Security Operations operating models.
• Experience working within highly regulated, global or federated organisations.
• Familiarity with cyber crisis management and executive incident response.
• Relevant certifications such as CISSP, CISM, GCIH, GCFA, GCED, CGEIT, CRISC, or equivalent.

Benefits

• Passionate, inspired people in a culture where extraordinary work is possible.
• Scale and opportunity to create, influence and complete projects at industry-leading scale.
• Challenging and stimulating work with a group of creative problem solvers.
• Hybrid working with teams in the office around four days a week.

Before you apply

• Candidates needing accommodations or flexibility should discuss this with the hiring team during the interview process.

About the company

WPP is a growth partner for the world's leading brands, combining media intelligence, creativity, production, enterprise solutions and strategic counsel. It works with leading brands across 100+ markets.