Senior Security Incident Responder

The role

Lead the technical response to the most complex and business-critical security incidents across WPP. Run investigations, forensics and containment, and act as the primary escalation point for stakeholders.

What you will do

• Lead investigations for high-severity and complex security incidents.
• Perform deep technical analysis using SIEM, SOAR, EDR/XDR, identity, email and cloud telemetry.
• Execute and oversee containment, eradication and recovery actions.
• Act as technical incident commander when delegated.
• Serve as the primary escalation point for complex incidents.
• Coordinate with Legal, Privacy, Risk, Technology Operations and agency teams.
• Lead forensic evidence collection, preservation and analysis.
• Review incident handling quality and improve playbooks and SOPs.
• Mentor Security Incident Responders without line management responsibility.
• Partner with Detection Engineering, Threat Intelligence, Automation and VM teams.

Required qualifications

• Extensive hands-on experience responding to enterprise-scale security incidents.
• Deep technical expertise across SIEM, SOAR, EDR/XDR, identity, email and cloud platforms.
• Strong forensic, investigation and root cause analysis skills.
• Ability to operate calmly under pressure and communicate clearly.

Nice to have

• Experience acting as incident commander or senior escalation point.
• Familiarity with MITRE ATT&CK and threat-led response.
• Relevant certifications: GCIH, GCFA, GCED, CISSP.

Benefits

• Passionate, inspired people who do extraordinary work.
• Scale and opportunity to create, influence and deliver projects.
• Challenging and stimulating work with creative problem solvers.

About the company

WPP is a growth partner for the world's leading brands, combining media intelligence, data, creativity, production and enterprise solutions. It works with major brands across 100+ markets.