About the Role:

The Senior Director, Digital Forensics & Incident Response owns AstraZeneca’s global capability to respond to and investigate cyber incidents. This role commands the enterprise response to material incidents across cloud, on-premises and OT/ICS environments; owns incident governance, readiness and the forensic defensibility of all collected evidence; and is accountable for executive reporting, lessons learned and the control hardening that follows.

This is a build role as AstraZeneca matures its internal incident response capability. The successful candidate will compose the function, hire the team and establish the standards under which it operates. The role leads through a Director, Forensics & Malware Analysis, and a global CSIRT working follow-the-sun alongside Regional Security Operations Centers in Macclesfield, Guadalajara, Chennai and Shanghai.

The role partners closely with Detection Engineering, Cyber Threat Intelligence, Threat Exposure Management, Insider Risk & DLP, IT, Legal, Privacy, Risk & Compliance, Corporate Communications, Insurance and Physical Security. Because AstraZeneca’s research and development intellectual property is a primary target for nation-state actors, and its manufacturing estate carries safety and supply consequences, the judgement exercised during an incident has consequences well beyond IT.

What You’ll Do:

• Incident Command: Act as the accountable commander for material and crisis-level cyber incidents, driving scoping, containment, eradication, recovery and investigation across hybrid cloud, on-premises and OT/ICS environments.

• Service Line Ownership: Own the Incident Response strategy, multi-year roadmap, operating budget and capability plan, setting direction and standards with a high degree of autonomy.

• Incident Governance: Define and maintain incident categories, severity definitions, activation criteria, decision authorities, delegation of authority during out-of-hours events and the handoff into enterprise crisis management.

• Forensic Defensibility: Through the Director, Forensics & Malware Analysis, ensure that evidence is preserved, collected and analysed with chain-of-custody rigor that stands up to legal and regulatory scrutiny. Own the relationship with Legal regarding litigation hold, privilege and retention.

• Readiness and Exercises: Run a calendar of tabletop, functional and purple-team exercises reaching from analyst level to the Executive Committee. Close findings and evidence improvement.

• Coverage Model: Guarantee 24x7 response coverage with credible follow-the-sun handoffs, issue paths and surge capacity, including in-country arrangements where data-localisation or sanctions constraints apply.

• Automation and AI: Operationalise agentic SIEM capability, XDR and SOAR playbooks, LLM-assisted runbooks and automated triage packages to compress mean time to detect, mean time to contain and mean time to respond without eroding evidentiary quality or human accountability.

• Metrics and Reporting: Own Incident Response targets and key risk indicators, including mean time to detect, contain and respond, dwell time, containment quality and business impact. Report these credibly to senior leadership.

• Executive and Board Communication: Deliver incident briefings, written updates and quarterly lessons-learned reviews to the CISO and IT leadership and, where warranted, the Audit Committee.

• Regulatory and Notification Support: Work with Legal, Privacy and Compliance to support breach-notification assessments and regulatory obligations across the countries in which AstraZeneca operates, including material-incident disclosure considerations.

• Controls Hardening: Drive post-incident detection and control improvements with Detection Engineering, Identity, Cloud, Endpoint, Network and OT teams.

Leading the Function:

• Build and Organization Design: Design and staff the DFIR function from a near-zero baseline, defining roles, levels, sourcing locations and the balance of permanent and retained capacity.

• Leading Through Leaders: Manage a Director-level leader and incident managers; set objectives, review performance and develop successors capable of commanding an incident in the Senior Director’s absence.

• Coverage and On-Call: Maintain on-call rotations, surge models and cross-regional handoff standards, and act as the senior critical issue point when severity demands it.

• Talent and Capability: Lead inclusive recruitment and build genuine career paths and upskilling in DFIR, cloud and identity forensics, OT/ICS, malware analysis and automation, using regional and external partnerships.

• Team Sustainability: Protect the team from the burnout that can follow sustained high-tempo response. Design rotations, recovery and workload distribution deliberately.

• Budget and Commercial Management: Own the service line budget, tooling and retainer spend, and build the case for further investment.

Knowledge, Experience and Understanding:

• Incident Command and the Incident Response Lifecycle: Proven command across the full lifecycle at enterprise scale, including preparation, detection, scoping, containment, eradication, recovery and post-incident review, supported by appropriate plans and playbooks.

• Digital Forensics and Evidence Handling: Experience managing the collection, preservation and analysis of digital evidence; chain of custody; timeline reconstruction; attribution; and concise executive reporting of forensic findings.

• Attacker Tradecraft: Deep working knowledge of the attack lifecycle and MITRE ATT&CK, common threat actor tactics, techniques and procedures, and the different behaviours of nation-state and ransomware operators once inside an environment.

• Automation and AI in Operations: Experience operationalising modern security tooling, including SIEM, SOAR and XDR, together with artificial intelligence, large language model and agentic capabilities to enable triage, analysis and eradication at scale, with clear human accountability for consequential decisions.

• Cloud, Identity and Endpoint Visibility: Understanding of telemetry and logging priorities across major cloud platforms, identity providers, operating systems and security tooling, including the forensic limitations of each.

• Operational Technology: Experience coordinating response in manufacturing OT/ICS environments where safety, validated systems and production continuity constrain responder actions.

• Regulated-Industry Constraints: Experience working within GxP and validated-system requirements, clinical and patient data sensitivities and third-party exposure considerations.

• Legal, Regulatory and Crisis Communications: Ability to build durable partnerships with Legal, Privacy, Risk and Compliance, Communications and Physical Security, and to operate comfortably under privilege.

• Vendor and Retainer Readiness: Experience maintaining retainer partner readiness and integrating external specialists during major incidents without losing command of the response.

Minimum Skills and Experience Required

• Education: Bachelor’s degree in information security, computer science or a related field, or equivalent practical experience.

• Professional Experience: Ten or more years of experience in cybersecurity, including seven or more years in incident response or digital forensics.

• Leadership Experience: Five or more years leading incident response in a large, complex enterprise, including at least two years managing other people leaders or managers.

• Command Experience: Demonstrable record as the accountable commander for high-severity incidents spanning hybrid cloud, on-premises and OT environments.

• Global Coordination: Experience running or integrating distributed 24x7 teams across multiple regions and cultures, including follow-the-sun handoffs.

• Communication and Facilitation: Ability to explain complex technical situations in clear business terms, produce concise written material under time pressure and lead briefings for senior executives.

• Analytical Decision-Making: Ability to assess incomplete information, weigh risk and balance strategic and tactical demands against business pragmatism and risk appetite.

• Cross-Functional Credibility: Demonstrated ability to collaborate across IT, Legal, GRC and Physical Security, with a strong service orientation.

• Availability: Willingness to serve as the senior escalation point outside business hours and to travel internationally as incidents and readiness activities require.

Desirable Skills and Experience

• Certifications: CISSP, CISM, GIAC certifications such as GCIH, GCFA, GREM or GNFA, and CCSP.

• Sector Experience: Experience in pharmaceutical, life sciences, healthcare or another highly regulated industry with significant manufacturing OT exposure.

• Board and Regulator Exposure: Experience briefing an audit committee or board, or engaging directly with regulators or law enforcement during a significant incident.

• Commercial Experience: Experience negotiating and governing Incident Response retainers and forensic vendor arrangements across multiple jurisdictions.

• Language Skills: Working proficiency in a second language relevant to AstraZeneca’s delivery hubs.