Cyber Incident Manager (CIM)

As a Cyber Incident Manager at Tesco, you will lead the coordinated response to cyber incidents, protecting the integrity of the retail ecosystem that serves millions of customers every day.
Acting as a central orchestrator, you will ensure swift, structured, and effective incident resolution, minimising operational disruption and customer impact.
This role is critical to maintaining trust in Tesco’s digital platforms by driving proactive, intelligence-led response and embedding continuous improvement across the cyber defence lifecycle.
You will operate at the intersection of technology, business impact, and customer outcomes, championing innovation and resilience.

• Lead Incident Orchestration: Direct end-to-end cyber incident management activities, coordinating cross-functional technical teams to ensure rapid containment, eradication, and recovery.
• Drive Effective Communication: Act as the central point of coordination during incidents, providing clear, concise, and timely updates to technical and non-technical stakeholders, including senior leadership.
• Enable Automated Response: Leverage Applied Artificial Intelligence (AI) and automation to enhance incident triage, prioritisation, and decision-making at pace.
• Optimise Operational Tooling: Utilise platforms such as Zendesk and xMatters to manage incidents, streamline workflows, and ensure high-quality service delivery.
• Embed Continuous Improvement: Translate lessons learned from incidents into actionable improvements across detection, response, and prevention capabilities.
• Collaborate Across Domains: Work closely with Security Operations, Threat Intelligence, Detection Engineering, and Technology teams to deliver a unified, customer-first cyber defence posture.
• Lead Through Change: Champion modern, agile ways of working, fostering innovation, resilience, and a culture of inclusion and continuous improvement within the incident response community.

Essential:

• Incident Leadership: Demonstrable understanding of cyber incident management and incident response processes, with the ability to coordinate complex, high-pressure situations effectively.
• Critical Thinking & Decision-Making: Strong analytical and problem-solving capability, with the ability to assess risk, prioritise actions, and make sound decisions under pressure.
• Communication & Influencing: Proven ability to communicate complex technical issues clearly and influence stakeholders across a diverse organisational landscape.
• Operational Tooling Expertise: Hands-on experience or exposure to incident management platforms such as Zendesk and xMatters in a cyber or operational environment.
• Applied Automation in Cyber Defence: Foundational understanding of how AI and automation can be applied to enhance cyber defence outcomes, particularly in incident detection and response.
• Technology Awareness: Broad exposure to core enterprise technology environments, with an understanding of how cyber incidents impact business-critical systems.
• Strategic Thinking: Ability to connect tactical incident response with broader strategic outcomes, driving improvements that enhance long-term resilience.
• Change Leadership: Experience in embracing and enabling change, promoting modern engineering and operational practices across teams.
• Collaboration & Inclusion: Demonstrable commitment to fostering inclusive, high-performing teams, working collaboratively across diverse technical and business functions.

Desirable:

• Exposure to digital forensics techniques and investigative practices.
• Familiarity with tools such as Jira for workflow and task management.
• Understanding of cloud and container security principles.
• Awareness of core cyber defence technologies (e.g., Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR)).
• Interest in data analytics and the use of insights to improve incident outcomes.
• Knowledge of development lifecycles and product-based delivery models.
• Awareness of retail technology environments and associated risks.
• Evidence of continuous learning, curiosity, and contribution to the wider cybersecurity profession.

You might know us as a supermarket, technology company or even for our award-winning mobile network. Truth is, we’re all of those things, and much more. Our colleagues work with one goal in mind, helping to make every day a little better for our customers, colleagues and communities all over the world. No two customers are the same, neither are our colleagues. At Tesco, we champion a balance that lets you thrive both in and out of work. Spend 60% of your week collaborating with colleagues at our office locations or local sites and the rest remotely. Whether you're just kicking off your career, juggling passions, or navigating big life events, we're here to support you. We always welcome a conversation about flexible working, so talk to us throughout your application about how we can support. We're proud to be an accredited Disability Confident Leader, where everyone’s welcome. That’s why we commit to providing a fully inclusive and accessible recruitment process. If you need support with your application, click here for more information. And if you're interested in joining our team but don't tick every box, don't let that hold you back from applying.