Cyber Security Incident Manager - Telecel Ghana

Role Purpose

The Cybersecurity Incident Manager plays a critical role in the organization's defense against cyber threats by leading the response to security incidents across the enterprise. This role requires deep expertise in the full information technology stack, including networks, endpoints, cloud environments and applications. The Cybersecurity Incident Manager will be responsible for managing and coordinating all phases of the incident response lifecycle from detection and containment to eradication and recovery while ensuring minimal impact to business operations.

Additionally, the role oversees the configuration and optimization of SIEM platforms and contribute to the continuous improvement of incident response processes and playbooks.

Key Accountabilities And Decision Ownership

• Lead and oversee cybersecurity incident response across the organization, ensuring swift and effective resolution of security events while serving as the technical authority during high-severity incidents.
• Coordinate cross-functional teams to deliver a unified and efficient incident response.
• Conduct forensic investigations, malware analyses, and compromise assessments to uncover root causes, attack vectors, IOCs, and advanced persistent threats (APTs).
• Manage and optimize SIEM platforms, integrate threat intelligence into workflows, and maintain incident response playbooks and procedures to strengthen detection and response capabilities.
• Manage the full lifecycle of security incidents, including detection, triage, containment, eradication, recovery, and post-incident review.
• Conduct deep investigations of compromised systems and malware to understand threat behavior, propagation methods, and mitigation strategies.
• Identify lateral movement, persistence mechanisms, and hidden threats to ensure complete eradication and restore system integrity.
• Validate alerts, escalate incidents, and improve threat detection and response capabilities.
• Review and optimize SIEM rules and use cases to enhance detection accuracy and reduce false positives.
• Integrate external threat intelligence feeds and correlate IOCs with internal data to uncover targeted and emerging threats.
• Build and maintain dashboards, reports, and metrics to monitor incident trends, SOC performance, and overall security posture.
• Administer SIEM platforms and digital assets to streamline log ingestion, event correlation, and response workflows.
• Develop playbooks, escalation protocols, and communication templates, and lead post-incident reviews to identify gaps and drive improvements.
• Implement security related automations, participate in tabletop exercises and red/blue team simulations, and stay current on emerging threats to refine response strategies and support proactive defense.

Core Competencies, Knowledge And Experience

• Proficient in managing the full incident lifecycle and conducting forensic investigations across endpoints, servers, and networks to uncover and interpret digital evidence.
• Skilled in reverse engineering malware, identifying indicators of compromise (IOCs), and detecting intrusion, persistence, and lateral movement.
• Experienced in administering SIEM platforms, tuning detection rules, and integrating threat intelligence to enhance proactive defense.
• Adept at collaborating with SOC teams to guide analysts, validate alerts, and improve detection through comprehensive log and telemetry analysis.
• Proficient in deploying and optimizing security systems and tools to streamline incident response and boost operational efficiency.
• Strong understanding of operating systems, networking protocols, cloud platforms, and enterprise applications.
• Demonstrated ability to lead cross-functional teams during incidents, ensuring coordinated and effective incident response.
• Highly analytical with strong problem-solving skills and attention to detail in forensic analysis, log review, and documentation.
• Expert-level understanding of the full incident response lifecycle covering preparation, detection, containment, eradication, recovery, and post-incident review aligned with frameworks like NIST SP 800-61, SANS, and MITRE ATT&CK.
• Proficient in digital forensics and malware analysis, including memory, disk, and network forensics, reverse engineering, and behavioral analysis of malicious code.
• Deep knowledge of SOC operations, including alert triage, escalation, and SIEM management log ingestion, correlation rule creation, and alert tuning across diverse data sources.
• Strong grasp of the threat intelligence lifecycle and compromise assessment, with the ability to correlate IOCs and TTPs, analyze APT behavior, and profile threat actors for proactive defense.
• Advanced understanding of network protocols (TCP/IP, DNS, HTTP/S, SMTP), operating systems, cloud platforms, and modern security technologies.
• Solid foundation in security policies, standards, and procedures for incident response and data protection, with expertise in regulatory compliance, risk assessment, and business impact analysis.
• Knowledge of security architecture and defense-in-depth strategies, including layered controls, vulnerability management, CVE analysis, and patching methodologies.
• Familiarity with security awareness initiatives, phishing simulations, and integrating incident response with business continuity and disaster recovery planning.

Must Have Technical / Professional Qualifications

• Bachelor's degree in cyber or information security, computer science, information technology (or systems) or other related fields.
• 8+ years of progressive experience in cybersecurity or related field in cybersecurity, with a significant focus on hands-on technical security work.
• Any of the certifications below or equivalent certifications will be desired; GCIA, GCIH, GCFA, GNFA, CEH. CISSP, OSCP, CISM

🔥 SIMILAR JOBS YOU MAY LIKE → APPLY