Average Incident Manager salary in the UK

WTW BenefitsEnjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.The RoleAs a Cyber Insurance Incident Manager at Willis, you will serve as an advisor and support lead for internal colleagues and clients facing cyber incidents. This role requires strong coordination and communication skills to support clients through high-stress events such as ransomware attacks, data breaches, and business email compromises. You will help ensure rapid response, align incident actions with insurance policy terms, and manage relationships with insurers, legal counsel, and technical vendors to protect client interests and minimize disruption.You will also support the coordination of incident support capabilities; including pre-, during and post- incident services.Key Responsibilities:Client Advocacy: Working alongside our cyber broking team to function as the incident manager for clients experiencing a cyber event—providing strategic guidance, triaging issues and supporting communication across stakeholders.Policy Interpretation: Help clients understand how their cyber insurance coverage applies in real time during an incident, identifying covered and uncovered elements and setting expectations accordingly.Vendor Coordination: Facilitate introductions to approved breach response vendors (forensics firms, privacy counsel, crisis communications, etc.) and ensure prompt engagement through insurer protocols.Insurer Liaison: Work closely with Willis Cyber Claims to escalate urgent needs and track the status of incidents and service provider approvals.Documentation & Reporting: Maintain detailed incident notes and assist clients in gathering documentation required for claims submissions and regulatory reporting.Post-Incident Review: Lead debrief sessions with client’s post-incident to identify lessons learned and recommend risk mitigation improvements.Client Education: Collaborate with producers and account executives to develop incident readiness materials, tabletop exercises, and client training. Also, present Willis’ wider incident management services as part of a new (or existing) client engagementInternal Enablement: Share incident trends, case studies, and feedback with broking and sales teams to strengthen coverage strategies and renewals.Stakeholder coordination: Develop a close collaboration with Coverage Advisory, Broking, Consulting and Claims to execute a comprehensive incident management offering.External media response and proactively drive brand awareness.The RequirementsExtensive experience in cyber insurance, incident response coordination, or cyber risk advisory—ideally within a brokerage, legal, or insurance services environment.All-Inclusive understanding of cyber insurance products, including coverages for breach response, business interruption, extortion, and regulatory liability.Familiarity with key cyber incident types (e.g., ransomware, email compromise, data exfiltration) and typical response workflows.Efficient interpersonal and client-facing skills; calm under pressure and able to build trust quickly.Excellent organizational skills and the ability to manage multiple high-priority cases simultaneouslyExtensive experience participating in managing or supporting cyber incidents.Additional Skills and ExperienceExperience in a client advisory role at a cyber insurance brokerage, insurance company or breach response firm.Professional certifications such as CIPP/US, GCIH or equivalent are desirable.Familiarity with insurer cyber panels and incident response ecosystems.Understanding of cyber and data privacy regulations.At WTW, we believe difference makes us stronger. We want our workforce to reflect the different and varied markets we operate in and to build a culture of inclusivity that makes colleagues feel welcome, valued, and empowered to bring their whole selves to work every day. We are an equal opportunity employer committed to fostering an inclusive work environment throughout our organisation. We embrace all types of diversity.We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please reach out.

Investigator - Cyber Incident Response Location Flexible (UK) Please Note: Due to the nature of client work you will be undertaking, you will need to be willing to go through a Security Clearance process as part of this role, which requires 5+ years UK address history at the point of application. Accenture is a leading global professional services company, providing a broad range of services in strategy and consulting, interactive, technology and operations, with digital capabilities across all of these services. With our thought leadership and culture of innovation, we apply industry expertise, diverse skill sets and next-generation technology to each business challenge.  We believe in inclusion and diversity and supporting the whole person. Our core values comprise of Stewardship, Best People, Client Value Creation, One Global Network, Respect for the Individual and Integrity. Year after year, Accenture is recognized worldwide not just for business performance but for inclusion and diversity too.   “Across the globe, one thing is universally true of the people of Accenture: We care deeply about what we do and the impact we have with our clients and with the communities in which we work and live. It is personal to all of us.”   Julie Sweet, Accenture CEO  If you’re looking for a challenging career working in a vibrant environment with access to training and a global network of experts, this is the role for you.?As part of our global team, you'll be working with cutting-edge technologies and will have the opportunity to develop a wide range of new skills.   At Accenture, our global Incident Response team takes on some of the hardest and most meaningful challenges in cyber security. When major organisations are breached, when ransomware hits the headlines, when espionage or insider threats threaten operations, we’re the people called to help.We’re looking for curious, capable people who love solving complex problems under pressure, thrive on collaboration, and want to work with the best in the industry.Who We AreWe’re a globally distributed team of nearly 200 dedicated incident responders, forensics specialists, and crisis managers spread across more than 25 countries. Every day, we work across time zones, cultures, and languages to protect clients that range from household brands to nationally significant infrastructure.We’re one of the NCSC CIR-enhanced capabilities in the UK (https://schemes/cyber-incident-response/information-for-buyers), meaning our team is trusted to respond to the nation’s most critical incidents, including ransomware, espionage, insider threats, and large-scale fraud.You’ll be joining a small team but backed by the scale and reach of Accenture - meaning you’ll always have the opportunity to grow, specialise, or even work in a different part of the world. What You’ll DoYou’ll help organisations investigate, contain, and recover from the full spectrum of cyber incidents, from sophisticated intrusions to complex fraud and ransomware.Between high-intensity engagements, you’ll also get to work proactively with clients, running tabletop exercises, purple-team operations, playbook development, and helping them build resilience before the next crisis strikes.You’ll collaborate closely with brilliant minds in forensics, threat intelligence, and crisis management, all working together to help clients make the right decisions in the toughest moments.

Our client an award winning SaaS organisation providing software solutions to the SME marketplace is now seeking an experienced Incident Management or Operations Analyst for a 12 month contract. Central London location, hybrid, with 2-3 days a week in the office.SkillsExperience in incident management, investigations, operations, or an analytical role in a service environment.Strong analytical skills using tools such as Google Workspace and Tableau.Comfortable using Slack, Salesforce, Jira, and similar operational tools.Ability to identify patterns in data and turn insights into actionable recommendations.ITIL Foundation preferred.Responsibilities:Support timely and consistent handling of incidents, investigations, and related case work.Ensure cases are triaged and progressed in line with expectations, highlighting gaps in speed, quality, or process.Perform root cause analysis and identify trends across incidents and recurring issues.Provide analytical insights that help prioritise fixes and improvements with Product and Engineering.Contribute to improvements that resolve issues more quickly.Benefits Global company, long contractHybrid roleFree breakfast