Senior Director, Digital Forensics & Incident Response

About the Role

The Senior Director, Digital Forensics & Incident Response owns AstraZeneca's global capability to respond to and investigate cyber incidents. This role commands the enterprise response to material incidents across cloud, on-premises and OT/ICS environments; owns incident governance, readiness and the forensic defensibility of all collected evidence; and is accountable for executive reporting, lessons learned and the control hardening that follows. This is a build role as AstraZeneca matures its internal incident response capability.

What You'll Do

• Incident Command: Act as the accountable commander for material and crisis-level cyber incidents, driving scoping, containment, eradication, recovery and investigation across hybrid cloud, on-premises and OT/ICS environments.
• Service Line Ownership: Own the Incident Response strategy, multi-year roadmap, operating budget and capability plan.
• Incident Governance: Define and maintain incident categories, severity definitions, activation criteria, decision authorities, delegation of authority during out-of-hours events and the handoff into enterprise crisis management.
• Forensic Defensibility: Ensure that evidence is preserved, collected and analysed with chain-of-custody rigor that stands up to legal and regulatory scrutiny. Own the relationship with Legal regarding litigation hold, privilege and retention.
• Readiness and Exercises: Run a calendar of tabletop, functional and purple-team exercises reaching from analyst level to the Executive Committee.
• Coverage Model: Guarantee 24x7 response coverage with credible follow-the-sun handoffs, issue paths and surge capacity.
• Automation and AI: Operationalise agentic SIEM capability, XDR and SOAR playbooks, LLM-assisted runbooks and automated triage packages.
• Metrics and Reporting: Own Incident Response targets and key risk indicators, including mean time to detect, contain and respond, dwell time, containment quality and business impact.
• Executive and Board Communication: Deliver incident briefings, written updates and quarterly lessons-learned reviews to the CISO and IT leadership and, where warranted, the Audit Committee.
• Regulatory and Notification Support: Work with Legal, Privacy and Compliance to support breach-notification assessments and regulatory obligations.
• Controls Hardening: Drive post-incident detection and control improvements with Detection Engineering, Identity, Cloud, Endpoint, Network and OT teams.
• Build and Organization Design: Design and staff the DFIR function from a near-zero baseline, defining roles, levels, sourcing locations and the balance of permanent and retained capacity.
• Leading Through Leaders: Manage a Director-level leader and incident managers; set objectives, review performance and develop successors.
• Talent and Capability: Lead inclusive recruitment and build genuine career paths and upskilling in DFIR, cloud and identity forensics, OT/ICS, malware analysis and automation.
• Budget and Commercial Management: Own the service line budget, tooling and retainer spend, and build the case for further investment.

Knowledge, Experience and Understanding

• Incident Command and the Incident Response Lifecycle: Proven command across the full lifecycle at enterprise scale.
• Digital Forensics and Evidence Handling: Experience managing the collection, preservation and analysis of digital evidence; chain of custody; timeline reconstruction; attribution; and concise executive reporting of forensic findings.
• Attacker Tradecraft: Deep working knowledge of the attack lifecycle and MITRE ATT&CK, common threat actor tactics, techniques and procedures.
• Automation and AI in Operations: Experience operationalising modern security tooling, including SIEM, SOAR and XDR, together with artificial intelligence, large language model and agentic capabilities.
• Cloud, Identity and Endpoint Visibility: Understanding of telemetry and logging priorities across major cloud platforms, identity providers, operating systems and security tooling.
• Operational Technology: Experience coordinating response in manufacturing OT/ICS environments.
• Regulated-Industry Constraints: Experience working within GxP and validated-system requirements, clinical and patient data sensitivities and third-party exposure considerations.
• Legal, Regulatory and Crisis Communications: Ability to build durable partnerships with Legal, Privacy, Risk and Compliance, Communications and Physical Security.
• Vendor and Retainer Readiness: Experience maintaining retainer partner readiness and integrating external specialists during major incidents.

Minimum Skills and Experience Required

• Education: Bachelor's degree
• Number of Years of Experience: 10+ years of experience
• Professional Experience: Demonstrated experience in cybersecurity, including incident response or digital forensics.
• Leadership Experience: Demonstrated experience leading incident response in a large, complex enterprise, including managing other people leaders or managers.
• Command Experience: Demonstrable record as the accountable commander for high-severity incidents spanning hybrid cloud, on-premises and OT environments.
• Global Coordination: Experience running or integrating distributed 24x7 teams across multiple regions and cultures, including follow-the-sun handoffs.
• Communication and Facilitation: Ability to explain complex technical situations in clear business terms, produce concise written material under time pressure and lead briefings for senior executives.
• Analytical Decision-Making: Ability to assess incomplete information, weigh risk and balance strategic and tactical demands against business pragmatism and risk appetite.
• Cross-Functional Credibility: Demonstrated ability to collaborate across IT, Legal, GRC and Physical Security.
• Availability: Willingness to serve as the senior escalation point outside business hours and to travel internationally as incidents and readiness activities require.

Desirable Skills and Experience

• Education: Bachelor's Degree in information security, computer science or a related field, or equivalent practical experience.
• Certifications: CISSP, CISM, GIAC certifications such as GCIH, GCFA, GREM or GNFA, and CCSP.
• Sector Experience: Experience in pharmaceutical, life sciences, healthcare or another highly regulated industry with significant manufacturing OT exposure.
• Board and Regulator Exposure: Experience briefing an audit committee or board, or engaging directly with regulators or law enforcement during a significant incident.
• Commercial Experience: Experience negotiating and governing Incident Response retainers and forensic vendor arrangements across multiple jurisdictions.
• Language Skills: Working proficiency in a second language relevant to AstraZeneca's delivery hubs.