I will build your cybersecurity incident response program
About this Gig
Is your organisation prepared to manage a serious cybersecurity incident?
I help CISOs, SOC leaders and IT managers assess and develop practical incident response programmes that clarify ownership, escalation, decision-making and recovery coordination.
Depending on your package, deliverables include:
- Incident management maturity and gap assessment
- Incident response framework, policy and procedures
- Severity classification, RACI and escalation workflows
- Customized playbooks for agreed threat scenarios
- SOC and security-tool workflow alignment
- KPIs, improvement roadmap and executive guidance
The Basic package provides an assessment and a prioritised roadmap.
Standard adds a documented programme and selected playbooks. Premium expands operational workflow design and stakeholder engagement.
Message me before ordering to confirm scope, confidentiality needs and deliverables.
FAQ
What is included in each package?
Basic provides a capability assessment and a 90-day roadmap. Standard adds the incident management framework, procedures and two playbooks. Premium includes expanded scenario coverage, operational workflow mapping and executive guidance.
Is the program customized?
Yes. Deliverables are tailored to the organisational scope, existing processes, stakeholder responsibilities and agreed security requirements.
Can you review our existing incident response plan?
Yes. I can assess existing documentation and identify governance, operational and response capability gaps within the package's agreed review limits.
Can you develop incident response playbooks?
Yes. Standard includes two agreed incident scenarios, and Premium includes four. Additional playbooks can be quoted separately.
Can you integrate the program with our SOC?
I provide SOC integration workflow design and technical requirements. Live SIEM, EDR or SOAR configuration and deployment are outside the scope of these packages.
Which security frameworks can you use?
The engagement may reference NIST incident response guidance, ISO/IEC 27035, or other agreed frameworks. Formal certification and regulatory compliance guarantees are excluded.
Will you sign an NDA?
I am willing to review and sign a mutually agreed NDA where appropriate. Please discuss confidentiality requirements before exchanging restricted organisational information.
What documents do you need?
A brief organisational overview, existing policies or plans if available, defined objectives and relevant stakeholder information. Sanitised materials are preferred; passwords and production access are not required.
What formats will I receive?
Reports, matrices and playbooks can be delivered in editable Word and Excel formats, with PDF versions where agreed. We confirm the exact deliverables before the order begins.
Do you provide incident response implementation?
The advertised packages focus on assessment, governance, programme design and operational integration requirements. Live incident handling, tool deployment, forensic investigations and production changes require a separate engagement.

