Vice President, Incident Response Lead

About the role

Mitsubishi UFJ Financial Group (MUFG) is looking for an Incident Response Team Lead to lead and develop the Incident Response function across the region. The role guides team members in investigating, containing and responding to cybersecurity incidents, drives improvements to playbooks and procedures, and coordinates stakeholders to strengthen the organisation's cyber resilience.

Key responsibilities

• Lead and coordinate the Incident Response team during incidents, covering triage, investigation, containment, eradication, recovery and follow-up.
• Provide technical direction, coaching and quality review for investigations, forensics, breach assessments and remediation.
• Improve incident response playbooks, escalation procedures, reporting templates, evidence handling and lessons learned.
• Run tabletop and attack simulation exercises and coordinate with internal and external stakeholders.
• Analyse artifacts, alerts, logs, network traffic and endpoints to determine intrusion methods, scope, root cause and remediation.
• Coordinate with Security Operations, IT, legal, risk management, compliance and external partners.
• Produce incident reports, executive updates and post-incident recommendations.
• Research emerging threats and turn them into improved detections and mitigations.
• Support audits and compliance requests, and contribute to detections, automation, monitoring and forensic capabilities.

Required profile

• Minimum 10 years in Cybersecurity Operations or Information Security.
• Proven experience leading or supervising cybersecurity operations, incident response, security investigations or a related technical team.
• Bachelor's degree in Information Technology, Cyber Security, Computer Science or a related discipline.
• Preferred: experience in SOC, incident response and computer forensics, and certifications such as GCFA, GCFE, GCIH, CISSP, CISM, CEH or GSEC.
• Strong leadership, prioritisation and stakeholder management skills.

Required skills

• Incident response: triage, investigation, containment, recovery and the full incident lifecycle.
• Operating systems (Linux, Windows), network, application and mobile device security.
• Log analysis, correlation and risk analysis; MITRE ATT&CK and Cyber Kill Chain.
• Tools such as CrowdStrike, Microsoft Defender, Tanium, Proofpoint and open-source forensics tools.
• Security frameworks (ISO 27001, NIST 800 series).