Senior Incident Responder, Hong Kong

{
  "content_hash": "8ce00b3be0cc398704b4f347868fe7917223652ff535e3a2101ba6862fed1c58",
  "source_hash": "7c0a6b45805a9c2acbb0e1486c456ef50698e3d1b53b7f92c9225a2ec1082f88",
  "last_changed_at": "2026-05-30T05:42:21.190Z",
  "active_status": "active"
}

{
  "language": "en",
  "location": {
    "raw": "Hong Kong Island, Hong Kong, Hong Kong",
    "city": "Hong Kong Island",
    "region": "Hong Kong",
    "country": null,
    "is_remote": false,
    "confidence": 0.8
  },
  "salary_max": null,
  "salary_min": null,
  "inferred_at": "2026-06-06T10:25:41.502Z",
  "launch_scope": {
    "reason": "bamboohr_production_catalog",
    "included": true,
    "location": {
      "raw": "Hong Kong Island, Hong Kong, Hong Kong",
      "city": "Hong Kong Island",
      "region": "Hong Kong",
      "country": null,
      "is_remote": false,
      "confidence": 0.8
    },
    "countries": []
  },
  "remote_policy": null,
  "salary_period": null,
  "workplace_type": null,
  "salary_currency": null
}

{}

{
  "list_job": {
    "id": "54",
    "isRemote": null,
    "location": {
      "city": "Hong Kong Island",
      "state": "Hong Kong"
    },
    "atsLocation": {
      "city": null,
      "state": null,
      "country": null,
      "province": null
    },
    "departmentId": "18607",
    "locationType": "0",
    "jobOpeningName": "Senior Incident Responder, Hong Kong",
    "departmentLabel": "Response",
    "employmentStatusLabel": "Full-Time"
  },
  "detail_errors": [],
  "detail_job_opening": {
    "location": {
      "city": "Hong Kong Island",
      "state": "Hong Kong",
      "postalCode": "Hong Kong",
      "addressCountry": "Hong Kong"
    },
    "datePosted": "2026-05-29",
    "atsLocation": {
      "city": null,
      "state": null,
      "country": null,
      "countryId": null
    },
    "description": "<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">About Blackpanda</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">Blackpanda is a Lloyd's of London–accredited insurance coverholder and Asia's leading local cyber incident response firm, delivering end-to-end digital emergency support across the region. We are pioneering the A2I (Assurance-to-Insurance) model in cybersecurity — uniting preparation, response, and insurance into a seamless pathway that minimizes financial and operational impact from cyber attack.<br><br></span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">Through expert consulting services, response assurance subscriptions, and innovative cyber insurance, we help organisations get ready, respond, and recover from cyber attacks — all delivered by local specialists working in concert. Our mission is clear: to bring complete cyber peace of mind to every organisation in Asia, from the first moment of breach through full recovery and beyond.<br><br></span></p>\n<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">How We Work</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">Blackpanda is a tech-enabled services team. We invest heavily in AI and are constantly pushing to do better, faster, and at scale. You are given freedom to use the approved tools in the team, but you are to take ownership of outcomes. We prefer smart work over hard work, welcome good ideas regardless of where they come from, and have deliberately kept red tape out of the way of innovation. If you want to join a team building the best response practice in Asia — and shaping the tools and methods that get us there — you'll be in good company.<br><br></span></p>\n<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">A Note on Levelling</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">This posting reflects a single role title; however, we hire across a range of seniority levels from this brief. The final title, whether DFIR Analyst, DFIR Specialist, or an adjacent level, will be determined by the depth and breadth of cybersecurity and incident response capabilities demonstrated throughout the interview process. If your experience sits near the edge of these levels, we encourage you to apply regardless.<br><br></span></p>\n<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Your Mission: Senior Incident Responder</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">As a Senior Incident Responder, you will lead engagements end-to-end — scoping new incidents, running the response, and seeing each case through to a defensible outcome for the client. You will typically carry multiple matters at a time (of standard complexity), guide junior responders through the work, and act as the senior technical voice in the room with clients.<br><br></span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">This is a hands-on leadership role. You are expected to deliver excellent work yourself, raise the level of work around you, and contribute back into the tools, playbooks, and processes that make the practice better over time. We want senior responders who think like operators and engineers — people who push the craft forward, not just keep the lights on.<br><br></span></p>\n<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Core Responsibilities</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Leading Engagement Delivery</span></p>\n<ul>\n<li><span style=\"font-size: 12pt\"><span style=\"font-family: Arial, sans-serif\">Lead live incident response engagements end-to-end — scoping, containment, evidence acquisition, forensic analysis, and final reporting — across BEC, ransomware/DFIR, data breach, compromise assessment, insider, and digital forensics cases.</span></span></li>\n<li>Run the technical investigation across Windows, Linux, macOS, and cloud environments, making the call on direction and standing behind the quality of findings.</li>\n<li>Carry multiple concurrent engagements of standard complexity, balancing competing priorities and keeping each case moving without dropping quality.</li>\n<li>Own the integrity of the work on every engagement you lead — chain of custody, evidence handling, deliverable quality, and the client experience throughout.<br><br></li>\n</ul>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Scoping &amp; Client Advisory</span></p>\n<ul>\n<li><span style=\"font-size: 12pt\"><span style=\"font-family: Arial, sans-serif\">Scope new incident response cases directly with clients — translating an ambiguous, high-pressure situation into a clear plan of action, deliverables, and commercial terms.</span></span></li>\n<li>Act as the senior technical point of contact for the client throughout the engagement, communicating findings, risk, and next steps with clarity and authority.</li>\n<li>Provide advisory input on remediation, recovery, and hardening, and recognise when to bring in additional capability — legal, insurance, or specialist services — to serve the client properly.<br><br></li>\n</ul>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Mentorship &amp; Team Leadership</span></p>\n<ul>\n<li><span style=\"font-size: 12pt\"><span style=\"font-family: Arial, sans-serif\">Guide junior responders through live engagements — assigning work, reviewing output, and coaching them on tradecraft, client posture, and judgement.</span></span></li>\n<li>Share what you know — through writeups, internal training, walkthroughs, and on-the-job mentoring — so the team gets stronger case over case.</li>\n<li>Lead delivery through others when the situation calls for it: scoping the work, dividing tasks, holding the line on quality, and stepping in technically where it matters most.<br><br></li>\n</ul>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Building Tools &amp; Processes</span></p>\n<ul>\n<li><span style=\"font-size: 12pt\"><span style=\"font-family: Arial, sans-serif\">Contribute to the continuous improvement of Blackpanda's playbooks, tooling, automation, and methodology — flag what is slow, brittle, or repeatable, and help fix it.</span></span></li>\n<li>Bring lessons from real engagements back into the practice so each case sharpens the next.</li>\n<li>Adopt AI and automation aggressively where they raise the floor or the ceiling of the work — we prefer smart work over hard work.<br><br></li>\n</ul>\n<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Minimum Requirements</span></p>\n<ul>\n<li><span style=\"font-size: 12pt\"><span style=\"font-family: Arial, sans-serif\">3+ years of professional cybersecurity experience, including hands-on incident response delivered in a client-facing role.</span></span></li>\n<li>Demonstrated ability to lead investigations end-to-end across common case types (e.g. BEC, ransomware/DFIR, data breach, compromise assessment, insider, digital forensics).</li>\n<li>Strong technical depth across Windows, Linux, and macOS, and working comfort with at least one major cloud provider.</li>\n<li>Scripting ability in Python, Bash, or PowerShell — strong enough to build collection, parsing, or automation tooling without supervision.</li>\n<li>Clear written and verbal English; able to author client deliverables, run client meetings, and represent Blackpanda in high-stakes situations.</li>\n<li>Sound judgement under ambiguity — comfortable making technical and commercial calls in fast-moving, incomplete-information situations.</li>\n<li>Calm under pressure, with the professional posture expected of a senior client-facing operator.<br><br></li>\n</ul>\n<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Preferred Qualifications</span></p>\n<ul>\n<li><span style=\"font-size: 12pt\"><span style=\"font-family: Arial, sans-serif\">Relevant certifications such as GCIH, GCFA, GREM, GNFA, GCFR, CISSP, OSCP, or equivalent.</span></span></li>\n<li>Deep hands-on experience with EDR, SIEM, and forensic tooling in real-world engagements.</li>\n<li>Track record of mentoring or training junior responders, formally or informally.</li>\n<li><span style=\"font-family: Arial, sans-serif\">Contribution to tooling, automation, or methodology improvements at a previous firm — open-source or internal.</span></li>\n<li>Additional languages relevant to the regions Blackpanda serves.<br><br></li>\n</ul>\n<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">How You'll Grow</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">You will own real engagements from day one, with the autonomy to make calls and a senior team around you to lean on. There is a clear path into leading more complex cases, technical specialisation, and broader team leadership for those who want it.<br><br></span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">You'll join a diverse team of teammates from around the world, where who you are, the quality of your work, and your character are what matter. Trying and failing is ok. Failing to try is not.<br><br></span></p>\n<p><span style=\"color: rgb(17, 17, 17); font-family: Arial, sans-serif; font-size: 12pt; font-weight: bold\">Why This Role</span></p>\n<p><span style=\"font-family: Arial, sans-serif; font-size: 12pt\">If you've built real incident response chops on the front line and you're ready to lead the work — scoping cases, running them through to completion, and bringing junior responders up with you — this is the seat. We're looking for senior responders who want to shape how the work gets done, not just execute someone else's playbook.</span></p>",
    "compensation": null,
    "departmentId": "18607",
    "locationType": "0",
    "seekPromoted": false,
    "jobCategoryId": null,
    "jobOpeningName": "Senior Incident Responder, Hong Kong",
    "departmentLabel": "Response",
    "jobOpeningStatus": "Open",
    "minimumExperience": "Senior Manager/Supervisor",
    "jobOpeningShareUrl": "https://blackpanda.bamboohr.com/careers/54",
    "employmentStatusLabel": "Full-Time"
  }
}