Senior Director, Digital Forensics & Incident Response

Owns AstraZeneca’s global capability to respond to and investigate cyber incidents. This role commands the enterprise response to material incidents across cloud, on-premises, and OT/ICS environments; owns incident governance, readiness, and the forensic defensibility of all collected evidence; and is accountable for executive reporting, lessons learned, and the control hardening that follows. The position leads through a Director, Forensics & Malware Analysis, and a global CSIRT working follow-the-sun alongside Regional Security Operations Centers in Macclesfield, Guadalajara, Chennai, and Shanghai. Partners closely with Detection Engineering, Cyber Threat Intelligence, Threat Exposure Management, Insider Risk & DLP, IT, Legal, Privacy, Risk & Compliance, Corporate Communications, Insurance, and Physical Security.

Responsibilities

• Incident Command: Act as the accountable commander for material and crisis-level cyber incidents, driving scoping, containment, eradication, recovery, and investigation across hybrid cloud, on-premises, and OT/ICS environments.
• Service Line Ownership: Own the Incident Response strategy, multi-year roadmap, operating budget, and capability plan, setting direction and standards with a high degree of autonomy.
• Incident Governance: Define and maintain incident categories, severity definitions, activation criteria, decision authorities, delegation of authority during out-of-hours events, and the handoff into enterprise crisis management.
• Forensic Defensibility: Through the Director, Forensics & Malware Analysis, ensure evidence is preserved, collected, and analyzed with chain-of-custody rigor that stands up to legal and regulatory scrutiny. Own the relationship with Legal regarding litigation hold, privilege, and retention.
• Readiness and Exercises: Run a calendar of tabletop, functional, and purple-team exercises reaching from analyst level to the Executive Committee. Close findings and evidence improvement.
• Coverage Model: Guarantee 24x7 response coverage with credible follow-the-sun handoffs, issue paths, and surge capacity, including in-country arrangements where data-localization or sanctions constraints apply.
• Automation and AI: Operationalize agentic SIEM capability, XDR and SOAR playbooks, LLM-assisted runbooks, and automated triage packages to compress mean time to detect, contain, and respond without eroding evidentiary quality or human accountability.
• Metrics and Reporting: Own Incident Response targets and key risk indicators, including mean time to detect, contain, and respond, dwell time, containment quality, and business impact. Report these credibly to senior leadership.
• Executive and Board Communication: Deliver incident briefings, written updates, and quarterly lessons-learned reviews to the CISO and IT leadership and, where warranted, the Audit Committee.
• Regulatory and Notification Support: Work with Legal, Privacy, and Compliance to support breach-notification assessments and regulatory obligations across the countries in which AstraZeneca operates, including material-incident disclosure considerations.
• Controls Hardening: Drive post-incident detection and control improvements with Detection Engineering, Identity, Cloud, Endpoint, Network, and OT teams.
• Build and Organization Design: Design and staff the DFIR function from a near-zero baseline, defining roles, levels, sourcing locations, and the balance of permanent and retained capacity.
• Leading Through Leaders: Manage a Director-level leader and incident managers; set objectives, review performance, and develop successors capable of commanding an incident in the Senior Director’s absence.
• Coverage and On-Call: Maintain on-call rotations, surge models, and cross-regional handoff standards, and act as the senior critical issue point when severity demands it.
• Talent and Capability: Lead inclusive recruitment and build genuine career paths and upskilling in DFIR, cloud and identity forensics, OT/ICS, malware analysis, and automation, using regional and external partnerships.
• Team Sustainability: Protect the team from burnout that can follow sustained high-tempo response. Design rotations, recovery, and workload distribution deliberately.
• Budget and Commercial Management: Own the service line budget, tooling, and retainer spend, and build the case for further investment.

Requirements

• Incident Command and the Incident Response Lifecycle: Proven command across the full lifecycle at enterprise scale, including preparation, detection, scoping, containment, eradication, recovery, and post-incident review, supported by appropriate plans and playbooks.
• Digital Forensics and Evidence Handling: Experience managing the collection, preservation, and analysis of digital evidence; chain of custody; timeline reconstruction; attribution; and concise executive reporting of forensic findings.
• Attacker Tradecraft: Deep working knowledge of the attack lifecycle and MITRE ATT&CK, common threat actor tactics, techniques, and procedures, and the different behaviors of nation-state and ransomware operators once inside an environment.
• Automation and AI in Operations: Experience operationalizing modern security tooling, including SIEM, SOAR, and XDR, together with artificial intelligence, large language model, and agentic capabilities to enable triage, analysis, and eradication at scale, with clear human accountability for consequential decisions.
• Cloud, Identity, and Endpoint Visibility: Understanding of telemetry and logging priorities across major cloud platforms, identity providers, operating systems, and security tooling, including the forensic limitations of each.
• Operational Technology: Experience coordinating response in manufacturing OT/ICS environments where safety, validated systems, and production continuity constrain responder actions.
• Regulated-Industry Constraints: Experience working within GxP and validated-system requirements, clinical and patient data sensitivities, and third-party exposure considerations.
• Legal, Regulatory, and Crisis Communications: Ability to build durable partnerships with Legal, Privacy, Risk and Compliance, Communications, and Physical Security, and to operate comfortably under privilege.
• Vendor and Retainer Readiness: Experience maintaining retainer partner readiness and integrating external specialists during major incidents without losing command of the response.

Qualifications

• Education: Bachelor’s degree in information security, computer science, or a related field, or equivalent practical experience.
• Professional Experience: Ten or more years of experience in cybersecurity, including seven or more years in incident response or digital forensics.
• Leadership Experience: Five or more years leading incident response in a large, complex enterprise, including at least two years managing other people leaders or managers.
• Command Experience: Demonstrable record as the accountable commander for high-severity incidents spanning hybrid cloud, on-premises, and OT environments.
• Global Coordination: Experience running or integrating distributed 24x7 teams across multiple regions and cultures, including follow-the-sun handoffs.
• Communication and Facilitation: Ability to explain complex technical situations in clear business terms, produce concise written material under time pressure, and lead briefings for senior executives.
• Analytical Decision-Making: Ability to assess incomplete information, weigh risk, and balance strategic and tactical demands against business pragmatism and risk appetite.
• Cross-Functional Credibility: Demonstrated ability to collaborate across IT, Legal, GRC, and Physical Security, with a strong service orientation.
• Availability: Willingness to serve as the senior escalation point outside business hours and to travel internationally as incidents and readiness activities require.

Skills

• Certifications (Desirable): CISSP, CISM, GIAC certifications such as GCIH, GCFA, GREM, or GNFA, and CCSP.
• Sector Experience (Desirable): Experience in pharmaceutical, life sciences, healthcare, or another highly regulated industry with significant manufacturing OT exposure.
• Board and Regulator Exposure (Desirable): Experience briefing an audit committee or board, or engaging directly with regulators or law enforcement during a significant incident.
• Commercial Experience (Desirable): Experience negotiating and governing Incident Response retainers and forensic vendor arrangements across multiple jurisdictions.
• Language Skills (Desirable): Working proficiency in a second language relevant to AstraZeneca’s delivery hubs.

Schedule

In-person working gives us the platform we need to connect, work at pace, and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office. Balance the expectation of being in the office while respecting individual flexibility.

Pay

The annual base pay for this position ranges from $190,957 - $286,435 USD. Hourly and salaried non-exempt employees will also be paid overtime pay when working qualifying overtime hours. Base pay offered may vary depending on multiple individualized factors, including market location, job-related knowledge, skills, and experience. In addition, this position offers a short-term incentive bonus opportunity; eligibility to participate in an equity-based long-term incentive program (salaried roles), retirement contribution (hourly roles), and commission payment eligibility (sales roles).

Benefits

• Qualified retirement program (401(k) plan).
• Paid vacation and holidays.
• Paid leaves.
• Health benefits including medical, prescription drug, dental, and vision coverage in accordance with the terms and conditions of the applicable plans.