Senior Incident Responder, Remote

About Blackpanda

Somewhere in Asia tonight, a server room is on fire. Not literally — though sometimes it might as well be. A ransomware note is blinking on a managing director's screen in a tower above Singapore. A family office in Hong Kong is locked out of its own ledgers. A trading desk in Japan is running orders on paper. Across the South China Sea in the Philippines, a hospitality group has just learned its booking system isn't its own anymore. Somewhere — Singapore, Hong Kong, Japan, the Philippines, Malaysia — a CIO is staring at the ceiling at three in the morning, wondering who to call.

That call comes to us.

Blackpanda is Asia's premier cyber crisis response firm — Lloyd's of London–accredited, regionally headquartered, and built for one purpose: to walk in when the worst has already happened, and walk out leaving the company still on its feet. We do incident response and digital forensics. That is it. No identity crisis about what we are. We are pure IR, and we like it that way.

Three channels, one operating force. We reach the market in three ways, and every channel feeds the same unit.

• Consulting. Hourly, senior-led engagements for enterprises and board-level matters where complexity, sensitivity, or scale demand our most experienced operators.
• IR-1. Our proprietary fixed-cost subscription is sold through IT channels and underwritten on our own insurance paper. IR-1 puts a real response solution in the hands of mid-market and small companies who have never been able to afford traditional cyber cover — paid up front, before the breach, with our team on the other end of every activation.
• Traditional cyber insurance. Full-stack policies for the mature, board-level buyer, with our response practice on the inside of every claim. Not a panel. Not a vendor. Our own people.

As a Lloyd's coverholder, the revenue arrives before the breach, not after it. Where traditional insurers park that float in markets, we pour ours straight back into the team — into people, training, tooling, and hours on the keyboard against real adversaries. Our gross margins run roughly two times those of traditional IR firms, and every point of that advantage compounds inside the unit.

The Cyber In-Extremis Force. At the centre of everything is the CIF.

Borrow the term from the special operations world and you'll understand what we mean by it. In extremis describes the moment a situation has moved beyond the tolerance of conventional units. When the building is already burning. When there is no time, no margin, no second chance. In-extremis forces are the no-fail option — who you call when calling anyone else means accepting the loss.

Blackpanda was founded by three former operators of the Commander's In-Extremis Force, one of five CIF teams the United States military positioned around the world, theirs based out of Okinawa. They built this firm because they had served inside the original — and they know what right looks like. How the best are selected. How the best are trained. How the best stand ready when the call comes. They are building the cyber equivalent the only way they know how: same standards, same discipline, same refusal to compromise on who gets to wear the patch.

We set a hard floor under who is allowed in the room. Every responder on the CIF roster holds — or is actively earning — multiple SANS Institute certifications, the most rigorous DFIR qualifications in the field. Network forensics, enterprise cloud, Linux, Windows, adversary tradecraft. The company pays for the coursework. The company pays for the certifications. The bar is not negotiable.

By the end of 2026, Blackpanda expects to field 25 full-time incident responders — by a wide margin the largest pure-IR team in Asia-Pacific and Japan. You want to run with the best? You have to be trained by the best. We do this so that one day there is no question — inside the firm or outside it — about who is the best.

How we work. Blackpanda is a tech-enabled services team. We invest heavily in AI and are constantly pushing to do better, faster, and at scale. You are given freedom to use the approved tools in the team, but you take ownership of outcomes. We prefer smart work over hard work, welcome good ideas regardless of where they come from, and keep red tape out of the way of innovation.

Our Core Values

• Sincerity — If we say we'll do it, it's as good as done. In combat, you have to know your right flank will be there at 0200 when they said they would. The work is the same.

• Unity — Debate fiercely, then commit fully. We all row in the same direction.

• Efficiency — Timing beats speed, precision beats power, leverage beats strength.

• Humility — Humility forms the basis of honor. We listen, then we act, then we listen again.

• Grit — We don't sugarcoat setbacks or bad news. We face challenges head-on and we don't quit when it gets hard.

Our story:

Blackpanda is Asia's leading cyber incident response company, delivering digital emergency response across three integrated channels: IR consulting, IR-1 assurance subscriptions, and Lloyd's of London-underwritten cyber insurance. Each is purpose-built for a different buyer, whether enterprise, mass market, or sophisticated risk-transfer clients, and each stands alone as full incident response. Together, these channels reach the entire commercial market, because our mission is to provide digital emergency response for everyone. Buy all three and they combine into the complete post-attack recovery solution: preparation in advance, response the moment you're hit, and financial recovery paid for by insurance. One local team to help you get ready, respond, and recover.

Our Mission: To provide digital emergency response to everyone.

Our Vision: Accessing cyber incident response is as universally accessible as dialing 9-1-1.

What we are looking for:

We are opening the search beyond our five office locations. This is a fully remote Senior Incident Responder seat, open to proven DFIR operators wherever they are based, who will lead engagements for clients across Asia-Pacific and Japan alongside our in-country teams.

As a Senior Incident Responder, you will lead engagements end-to-end: scoping new incidents, running the response, and seeing each case through to a defensible outcome for the client. You will typically carry multiple matters at a time, guide junior responders through the work, and act as the senior technical voice in the room with clients. You will report to one of our Response Directors.

This is a hands-on leadership role, not a first step into incident response. You are expected to deliver excellent work yourself, raise the level of work around you, and contribute back into the tools, playbooks and processes that make the practice better over time. We want senior responders who think like operators and engineers and push the craft forward.

Responsibilities and Duties:

Leading engagement delivery

• Lead live incident response engagements end-to-end: scoping, containment, evidence acquisition, forensic analysis and final reporting, across BEC, ransomware, data breach, compromise assessment, insider and digital forensics cases.
• Run the technical investigation across Windows, Linux, macOS and cloud environments, making the call on direction and standing behind the quality of findings.
• Carry multiple concurrent engagements, balancing competing priorities and keeping each case moving without dropping quality.
• Own the integrity of the work on every engagement you lead: chain of custody, evidence handling, deliverable quality, and the client experience throughout.

Triage, scoping and client advisory

• Take part in the on-call triage rotation for retainer and IR-1 activations, and deliver clear initial containment advice to the client promptly after the triage call.
• Scope new incident response cases directly with clients, translating an ambiguous, high-pressure situation into a clear plan of action, deliverables and commercial terms.
• Act as the senior technical point of contact for the client throughout the engagement, communicating findings, risk and next steps with clarity and authority.
• Provide advisory input on remediation, recovery and hardening, and recognise when to bring in additional capability (legal, insurance or specialist services).

Mentorship and team leadership

• Guide junior responders through live engagements: assigning work, reviewing output, and coaching them on tradecraft, client posture and judgement.
• Share what you know through writeups, internal training, walkthroughs and on-the-job mentoring, so the team gets stronger case over case.
• Lead delivery through others when needed: scoping the work, dividing tasks, holding the line on quality, and stepping in technically where it matters most.

Building tools and processes

• Contribute to Blackpanda's playbooks, tooling, automation and methodology. Flag what is slow, brittle or repeatable, and help fix it.
• Bring lessons from real engagements back into the practice so each case sharpens the next.
• Adopt AI and automation wherever they improve the speed or quality of the work.

Qualifications and Experience:

Hard requirement: you must have at least 3 years of full DFIR caseload experience. That means leading or carrying hands-on incident response and forensic investigations for clients, end to end. SOC/MDR alert triage, threat intelligence, GRC, vulnerability management or penetration testing do not count towards this on their own. If you do not meet this bar, please do not apply; your application will not progress.

Minimum requirements

• 3+ years of full DFIR caseload work, delivered in a client-facing incident response role (consultancy, MSSP IR team, or in-house CSIRT handling real incidents).
• Demonstrated ability to lead investigations end-to-end across common case types (BEC, ransomware, data breach, compromise assessment, insider, digital forensics). Be ready to walk us through cases you personally led.
• Strong technical depth across Windows, Linux and macOS, and working comfort with at least one major cloud provider (AWS, Azure/M365 or GCP).
• Scripting ability in Python, Bash or PowerShell, strong enough to build collection, parsing or automation tooling without supervision.
• Professional written and spoken English: able to author client deliverables, run client meetings, and represent Blackpanda in high-stakes situations.
• Sound judgement under ambiguity, and calm under pressure, with the posture expected of a senior client-facing operator.
• Excellent written and verbal communication in English.

Preferred qualifications

• SANS/GIAC certifications such as GCFA, GCIH, GNFA, GCFR or GREM; other relevant certifications such as CISSP or OSCP.
• Deep hands-on experience with EDR, SIEM and forensic tooling in real-world engagements.
• Fluency in one or more additional languages used across our markets (e.g. Japanese, Mandarin, Cantonese, Korean, Bahasa Malaysia/Indonesia, Tagalog).
• Track record of mentoring or training junior responders, formally or informally.
• Contribution to tooling, automation or methodology improvements, open-source or internal.
  
  

Working remotely with us:

• Location: you can be based anywhere, provided you can work reliably across Asia-Pacific and Japan business hours (roughly GMT+7 to GMT+10).
• On-call: you will join the response on-call rotation. Incidents do not keep office hours, and missed pages are treated seriously.
• Travel: expect occasional travel for on-site engagements where a case requires it, plus the annual week-long Tribe Onsite.
• Compensation: pay is set against the salary band for the country you are based in.
• Setup: a secure, private working space and a stable, high-speed internet connection suitable for handling sensitive client evidence.
  
  

What we offer:

• 40 days paid leave per year inclusive of public holidays, which may be taken at the discretion of the employee subject to compliance with our Leave Policy and the approval of their manager.
• Enrolment in the company's comprehensive corporate health plan that includes a large direct billing network for medical and dental coverage.
• Opportunities for inter-office travel, including a required annual week-long Tribe Onsite meet-up.
• $5000 USD/year for professional training budget contingent on approval from manager with 12-month retention requirement
• Competitive base salary with performance-based variable compensation tied to market results, plus equity participation in Blackpanda's growth.
• Real engagements from day one, with a clear path into leading more complex cases, technical specialisation, and broader team leadership.
  
  

Declamation:

Candidates who successfully pass the Interview stage may be required to complete a Case Study, used to evaluate their technical knowledge and application of their skills in practical scenarios relevant to the role.

Blackpanda is committed to building a culturally diverse company, and we value a broad set of opinions in our team. As we grow, we are looking to build a team with a range of viewpoints at its core, and we encourage applications from minority candidates and all genders however you identify (X/F/M).

Blackpanda does not accept unsolicited resumes from recruitment agencies. We will not be responsible for any fees related to unsolicited candidates submitted by recruiters with whom we have not established explicit, written agreements for our job vacancies. By submitting any candidate information, recruiters agree to forfeit any claim to fees should their candidate be hired without an established agreement with Blackpanda.