Hiring an Incident Response Manager (CSIRT Lead)

On the day of a major attack, strong analysts are not enough: someone has to decide, coordinate and brief the executive team while the investigation runs. That is the job of the incident response manager, often called the CSIRT or CERT lead. This guide helps you define the role, recognise the right profile and assess candidates on what really matters: keeping control when everything speeds up.

What an incident response manager actually does

A CSIRT lead is not simply the most experienced analyst on the team. They are the one steering. They may still investigate, but their value shows in how the whole team performs before, during and after an incident.

Their most common responsibilities:

Prepare: write and maintain response procedures, playbooks and the crisis communication plan, and check that the right logs exist and are kept long enough.
Lead incidents: assess severity, trigger escalation, split work between analysts, and weigh fast containment against a full investigation.
Coordinate: act as the link with IT, legal, communications, the data protection officer, the insurer and, where relevant, an external provider.
Report: keep leadership informed with regular, clear and honest updates on what is under control and what is not yet.
Meet obligations: make sure notifications go out on time, for example to the data protection authority after a personal data breach.
Learn: run post-incident reviews, follow up corrective actions and improve detection together with the SOC.
Train: run crisis exercises and tabletop simulations, and grow the team's skills over time.

Why this role is becoming necessary

The NIS2 directive (Directive (EU) 2022/2555) requires in-scope entities to handle incidents in a structured way and to notify the competent authority in stages: an early warning within 24 hours of becoming aware of a significant incident, a notification within 72 hours, then a final report. In France, ANSSI supports implementation. The GDPR, for its part, requires notifying the supervisory authority (the CNIL in France) within 72 hours of a personal data breach that poses a risk.

Meeting those deadlines in the middle of a crisis cannot be improvised. You need someone who knows the obligations, has prepared the decision paths and can produce reliable information under pressure. Our article on the profiles to hire for NIS2 shows where this role fits in the bigger picture.

In-house manager, technical lead or provider: clarify the need

Before writing the job ad, decide what you actually expect. The three options are not mutually exclusive.

Option	Main role	When to choose it
In-house CSIRT manager	Prepares, leads crises, manages a team, reports to leadership	You have a security team, regular incidents and notification obligations
Incident response lead	Technical reference who handles the hardest investigations, without formal line management	Your team is small and the CISO already owns crisis leadership
Incident response provider	External on-demand support, often under a retainer	You lack the volume for an in-house team. In France, ANSSI qualifies providers under the PRIS label

Many organisations combine an in-house manager with a provider on retainer to absorb major incidents. In that case, the in-house manager must know how to steer a provider, not just work alone. If overall security governance still has to be built, you may want to start by hiring a CISO.

The profile to look for

A solid technical base

A CSIRT lead who has never investigated cannot judge the quality of an analysis or spot a rushed conclusion. Look for real investigation experience: Windows endpoints, Active Directory, network logs and, increasingly, cloud environments. The candidate does not need to be the best technician on the team, but they must know which question to ask the analyst who is.

Genuine leadership under pressure

This is what separates the role from a senior analyst position. It takes prioritising, delegating, keeping an incident log, running status updates at fixed times and saying no to requests that would cost the team time.

Communication tuned to each audience

The same incident is told differently to an analyst, a general counsel and a CEO. A strong candidate adjusts the level of detail without bending the facts, and can deliver bad news without drama or understatement.

Where good candidates come from

Experienced incident response analysts who have already run incidents end to end. To assess their technical foundations, our list of incident response analyst interview questions is still useful.
SOC managers who want to move from detection to response. Check their experience of deep investigation and crisis management.
Consultants from incident response providers who have seen many environments. Check that they want to stay and build, not only parachute in.

The skills to assess

Here is a simple scorecard to share with everyone on the panel:

Investigation: can they rebuild a timeline and separate facts from hypotheses?
Prioritisation: faced with several emergencies, what criteria do they use?
Decision making: will they decide on incomplete information, and do they record their decisions?
Coordination: how do they organise five people's work over three days of crisis?
Communication: can they brief an executive in two minutes?
Regulatory awareness: do they know which notification obligations apply to your organisation?
Continuous improvement: what do they actually do after an incident so the same path no longer works?
Management: how do they protect their team from burnout during and after a crisis?

Specialist incident response or digital forensics certifications show that someone has studied. They do not prove the ability to lead. Our article on cybersecurity certifications explains what they are really worth in hiring.

An exercise that reveals the level

A classic interview is poor at measuring leadership. A 45 minute tabletop simulation, run by someone from your security team, tells you far more.

Set an opening scenario, for example an EDR alert on a file server late on a Friday, then add information every five to ten minutes:

a privileged account used outside normal hours;
a journalist calling the switchboard;
a business owner refusing to isolate a critical server;
an analyst on the team who cannot be reached;
leadership asking, at 9 p.m., whether customers should be told.

Watch the method more than the technical answers. Does the candidate ask questions before acting? Do they name an owner for each action? Do they set the time of the next update? Do they think of notification deadlines without being prompted? Do they close with a clear summary of the situation?

Add an interview with leadership or the CISO focused on communication, and a conversation with one or two analysts from the team. To structure the whole process, use our method for assessing cybersecurity skills.

Common mistakes

Promoting the best technician by default: excellence in investigation guarantees neither the appetite nor the talent for leadership.
Hiring without a clear mandate: if the CSIRT lead cannot isolate a machine without three sign-offs, they carry the responsibility without the authority.
Forgetting on-call duty: pace, compensation and rotation should come up in the first interview, not at offer stage.
Ignoring preparation: a role sold purely as crisis management attracts people who will be bored between incidents. Preparation and exercises are part of the job.
Underestimating pay: it varies with team size, sector, regulation and on-call load. Set a realistic range from the start so you do not lose a strong candidate at the last step.

In short

An incident response manager combines a solid technical base, real leadership and communication tuned to each audience. To hire well, first clarify their mandate and how they will work with any external provider, then assess them on a crisis simulation rather than on a list of tools or certifications.

Hiring a CSIRT manager or an incident response lead? At Cyber Recrut, a recruiter and a security practitioner scope the need with you, and our shortlisted candidates prove their skills on hands-on labs built around your role. See how we work or tell us about your hiring need.