Average Incident Manager salary in the UK

WTW BenefitsEnjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.The RoleAs a Cyber Insurance Incident Manager at Willis, you will serve as an advisor and support lead for internal colleagues and clients facing cyber incidents. This role requires strong coordination and communication skills to support clients through high-stress events such as ransomware attacks, data breaches, and business email compromises. You will help ensure rapid response, align incident actions with insurance policy terms, and manage relationships with insurers, legal counsel, and technical vendors to protect client interests and minimize disruption.You will also support the coordination of incident support capabilities; including pre-, during and post- incident services.Key Responsibilities:Client Advocacy: Working alongside our cyber broking team to function as the incident manager for clients experiencing a cyber event—providing strategic guidance, triaging issues and supporting communication across stakeholders.Policy Interpretation: Help clients understand how their cyber insurance coverage applies in real time during an incident, identifying covered and uncovered elements and setting expectations accordingly.Vendor Coordination: Facilitate introductions to approved breach response vendors (forensics firms, privacy counsel, crisis communications, etc.) and ensure prompt engagement through insurer protocols.Insurer Liaison: Work closely with Willis Cyber Claims to escalate urgent needs and track the status of incidents and service provider approvals.Documentation & Reporting: Maintain detailed incident notes and assist clients in gathering documentation required for claims submissions and regulatory reporting.Post-Incident Review: Lead debrief sessions with client’s post-incident to identify lessons learned and recommend risk mitigation improvements.Client Education: Collaborate with producers and account executives to develop incident readiness materials, tabletop exercises, and client training. Also, present Willis’ wider incident management services as part of a new (or existing) client engagementInternal Enablement: Share incident trends, case studies, and feedback with broking and sales teams to strengthen coverage strategies and renewals.Stakeholder coordination: Develop a close collaboration with Coverage Advisory, Broking, Consulting and Claims to execute a comprehensive incident management offering.External media response and proactively drive brand awareness.The RequirementsExtensive experience in cyber insurance, incident response coordination, or cyber risk advisory—ideally within a brokerage, legal, or insurance services environment.All-Inclusive understanding of cyber insurance products, including coverages for breach response, business interruption, extortion, and regulatory liability.Familiarity with key cyber incident types (e.g., ransomware, email compromise, data exfiltration) and typical response workflows.Efficient interpersonal and client-facing skills; calm under pressure and able to build trust quickly.Excellent organizational skills and the ability to manage multiple high-priority cases simultaneouslyExtensive experience participating in managing or supporting cyber incidents.Additional Skills and ExperienceExperience in a client advisory role at a cyber insurance brokerage, insurance company or breach response firm.Professional certifications such as CIPP/US, GCIH or equivalent are desirable.Familiarity with insurer cyber panels and incident response ecosystems.Understanding of cyber and data privacy regulations.At WTW, we believe difference makes us stronger. We want our workforce to reflect the different and varied markets we operate in and to build a culture of inclusivity that makes colleagues feel welcome, valued, and empowered to bring their whole selves to work every day. We are an equal opportunity employer committed to fostering an inclusive work environment throughout our organisation. We embrace all types of diversity.We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please reach out.

We have a great opportunity to join Sovereign Network Group (SNG) as a HSE Incident and Investigation Specialist within our People and Transformation team. You'll be based ideally from our Basingstoke office with flexibility around being based from our other locations. This role will combine office and home working to ensure a positive work/life balance. It's an exciting time to join us as Sovereign have joined forces with Network Homes to form SNG (Sovereign Network Group). Together we provide over 84,000 homes and invest in communities across London and the South of England – our purpose being to provide quality affordable homes and places that people love for generations. The Role In this role, to provide specialist advice, guidance and support to the organisation in incident classification, reporting, investigation and trend analysis. To provide incident triage, and severity identification related to HSE incident management. To build organisational capability to learn from incidents. Key Responsibilities Triage all HSE incidents within the E-safe reporting system, assigning severities and ensuring accuracy in record detailCoach and support incident investigators to continuously improve and achieve professional excellence in the quality of investigations and investigation reportsLead the development and implementation of industry leading practices for investigating and learning from incidents, applying the core principles of human and organisational performanceAdvance safety culture change by applying principles of just and fair culture to investigationsLead the analysis of incidents and incident causation trends, producing reports from that data drawing out meaningful conclusions and clear recommendationsEnsure prompt escalation of LTI/RIDDOR/HiPo to HSE Managers and senior advisors for investigation We are looking for someone who has Experience in HSE roles Deep understanding of Health & Safety regulationsNebosh National General CertificateExperience investigating complex health & safety incidents in construction related environmentNEBOSH Level 6 National Diploma in Occupational Health and Safety Benefits We have some great benefits at SNG, including:  25 Days Holiday + Bank Holidays (with an extra day every year up to 30 days)Chance to buy or sell holiday as part of our flexible benefits package3 additional Wellbeing days and 2 paid volunteering daysGenerous matched pension scheme up to 12% and Life cover at 4x salary Enhanced maternity/adoption pay Enhanced paternity pay - 6 weeks full pay (after 26 weeks' service)Options for private medical insurance, dental insurance and critical illness coverWellbeing discounts, including Gym Memberships and access to a 24/7 virtual GP service We are committed to our Equality Diversity and Inclusion strategy and believe that you can truly be yourself at SNG. This is a great opportunity to join the team as we progress through an exciting period of change at SNG. We pride ourselves on having a relaxed, supportive and forward-thinking culture, working collaboratively to achieve success.

Lead Cybersecurity Incident Responder - IR, Cyber, Salary: Competitive, based on experience + benefitsLocation: London / Hybrid (some travel European travel) About the Organisation This forward-thinking cybersecurity intelligence organisation is recognised as a European leader, partnering with some of the most prominent brands to anticipate, prevent, and respond to emerging threats. You will be joining a highly skilled team made up of some of the sharpest minds in the industry, offering an environment where you can grow, innovate, and make a real impact.Who We're Looking For We are seeking a highly experienced cybersecurity professional with a strong background in incident response and advanced security operations. Essential experience and skills: * Extensive hands-on experience in Incident Response (IR), SOC, MSSP, CSIRT, or DFIR, with a proven ability to handle urgent and complex client incidents under pressure.* European language is beneficial but not required.* Experience working in a 24/7 SOC environment, with a deep understanding of how SOC operations integrate with IR.* Expert knowledge of technologies such as Microsoft security stack, DFIR tooling, SIEM, Microsoft Defender/Sentinel, EDR platforms, timeline analysis, and cloud environments (Azure, AWS, or GCP).* Exposure to penetration testing, including red team or purple team exercises, is advantageous.* Ability to script or automate using Bash, Perl, Python, or PowerShell.* Strong analytical mindset and familiarity with hypothesis-driven investigation methods.* Confident understanding of compliance, legal requirements, and managing third-party vendor relationships.* Solid working knowledge of the MITRE ATT&CK framework.* Willingness to take part in on-call rotations.* Excellent understanding of the cybersecurity landscape and its impact on modern organisations. Highly desirable certifications:CISSP, CISM, OSCP, GIAC, GCIH, GCFA, GCFE, GPEN, GNFA (holding at least one is preferred).What You'll Be Doing As the Lead Cybersecurity Incident Responder, you will play a critical role in guiding clients through high-impact, time-sensitive security incidents. Your responsibilities will include: * Conducting network, host, and forensic investigations, presenting clear and actionable findings to clients.* Providing on-call emergency support and leading swift, effective response actions.* Handling complex and sensitive IR engagements across a wide range of industries and technical environments.* Acting as a trusted advisor, consulting directly with clients and collaborating with senior leadership.* Producing detailed technical reports and executive-level summaries.* Mentoring and supporting junior members of the team.This is an exciting opportunity to join a dynamic, highly respected organisation and contribute to meaningful cybersecurity work that protects organisations across Europe.About AdeccoAdecco is acting as an Employment Agency. We are proud to be an equal opportunities employer. We are on the client's supplier list for this position. Keywords Incident Response, Cyber Incident Responder, DFIR, Digital Forensics, SOC Analyst, Lead Incident Responder, Cybersecurity Analyst, SIEM, Microsoft Sentinel, Microsoft Defender, EDR, Azure Security, AWS Security, GCP Security, Threat Hunting, Cyber Threat Intelligence, MITRE ATT&CK, Red Team, Purple Team, Malware Analysis, Cyber Forensics, Security Operations, Security Engineer, On-Call IR, Penetration Testing, Python, PowerShell, Bash, Cyber Defence, CSIRT, MSSP, Network Forensics, Endpoint Forensics, Cloud Security, IR Lead, Security Consultant.