About Blackpanda
Blackpanda is Asia's leading cyber incident response company, delivering digital emergency response across three integrated channels: IR consulting, IR-1 assurance subscriptions, and Lloyd's of London-underwritten cyber insurance. Each is purpose-built for a different buyer, whether enterprise, mass market, or sophisticated risk-transfer clients, and each stands alone as full incident response. Together, these channels reach the entire commercial market, because our mission is to provide digital emergency response for everyone. Buy all three and they combine into the complete post-attack recovery solution: preparation in advance, response the moment you're hit, and financial recovery paid for by insurance. One local team to help you get ready, respond, and recover.
How We Work
Blackpanda is a tech-enabled services team. We invest heavily in AI and are constantly pushing to do better, faster, and at scale. You are given freedom to use the approved tools in the team, but you are to take ownership of outcomes. We prefer smart work over hard work, welcome good ideas regardless of where they come from, and have deliberately kept red tape out of the way of innovation. If you want to join a team building the best response practice in Asia — and shaping the tools and methods that get us there — you'll be in good company.
A Note on Levelling
This posting reflects a single role title; however, we hire across a range of seniority levels from this brief. The final title, whether DFIR Analyst, DFIR Specialist, or an adjacent level, will be determined by the depth and breadth of cybersecurity and incident response capabilities demonstrated throughout the interview process. If your experience sits near the edge of these levels, we encourage you to apply regardless.
Your Mission: Senior Incident Responder
As a Senior Incident Responder, you will lead engagements end-to-end — scoping new incidents, running the response, and seeing each case through to a defensible outcome for the client. You will typically carry multiple matters at a time (of standard complexity), guide junior responders through the work, and act as the senior technical voice in the room with clients.
This is a hands-on leadership role. You are expected to deliver excellent work yourself, raise the level of work around you, and contribute back into the tools, playbooks, and processes that make the practice better over time. We want senior responders who think like operators and engineers — people who push the craft forward, not just keep the lights on.
Core Responsibilities
Leading Engagement Delivery
- Lead live incident response engagements end-to-end — scoping, containment, evidence acquisition, forensic analysis, and final reporting — across BEC, ransomware/DFIR, data breach, compromise assessment, insider, and digital forensics cases.
- Run the technical investigation across Windows, Linux, macOS, and cloud environments, making the call on direction and standing behind the quality of findings.
- Carry multiple concurrent engagements of standard complexity, balancing competing priorities and keeping each case moving without dropping quality.
- Own the integrity of the work on every engagement you lead — chain of custody, evidence handling, deliverable quality, and the client experience throughout.
Scoping & Client Advisory
- Scope new incident response cases directly with clients — translating an ambiguous, high-pressure situation into a clear plan of action, deliverables, and commercial terms.
- A