Cyber Incident Response - CSIRT Team Lead

• Work anywhere in New Zealand
• Permanent, full-time role.

Health New Zealand | Te Whatu Ora is the country's largest employer, delivering universal public healthcare to 5 million New Zealanders.

We provide essential hospital, specialist, and community health services across 80+ locations - from large urban centres to rural towns and remote communities.

Our goal is to improve health outcomes for all New Zealanders by delivering equitable, accessible and innovative care.

About the Role

As CSIRT Team Lead, you will provide operational and people leadership for Health New Zealand Te Whatu Ora's national Cyber Security Incident Response Team (CSIRT), ensuring coordinated, high-quality response to cyber security incidents across a complex and distributed health system. You will oversee day-to-day CSIRT operations, workflow, prioritisation and escalation, ensuring incidents are managed effectively with patient safety, continuity of clinical services, risk and equity considerations at the forefront. Working within the National Security Operations Centre (NSOC) environment, you will coordinate incident response activities from triage and investigation through containment, recovery and post-incident review, including significant incidents managed through established incident management frameworks such as CIMS.

This is a leadership-focused role that also requires strong technical credibility. You will provide guidance and quality assurance to CSIRT analysts and engineers, support consistent application of incident response and DFIR practices, and act as an escalation point for complex or high-impact incidents. A key focus will be building team capability through coaching, development, exercises, playbooks, automation and continuous improvement, while fostering a culture of psychological safety, accountability and professional growth. You will work closely with cyber security, digital, clinical and business teams, senior leaders and external partners to strengthen national cyber resilience and ensure cyber incidents are managed in a way that supports safe and equitable health outcomes.

About the Team/Service/ Location

The Cyber Security Incident Response Team forms part of Health New Zealand's national cyber security capability, working closely with the National Security Operations Centre (NSOC), Security Operations, Threat Intelligence, Cyber Engineering, Digital ICT, clinical and business teams. The team plays a critical role in protecting health information, digital services and systems that underpin the delivery of healthcare across New Zealand. Working in a complex and nationally distributed environment, CSIRT responds to a wide range of cyber security events and incidents while supporting preparedness, resilience, continuous improvement and national capability uplift.

This is an opportunity to join a team operating at the intersection of cyber security, critical infrastructure and patient safety. You will work collaboratively with internal stakeholders and external partners including NCSC/CERT NZ, incident response and forensic providers, technology partners, government agencies and law enforcement where appropriate. The role requires a collaborative and inclusive approach, with a strong commitment to Te Tiriti o Waitangi, equity, Māori and Pacific health outcomes, staff wellbeing and building a capable national cyber security workforce.

About you

You will be an experienced cyber security professional and people leader who can provide calm, decisive and credible leadership during complex and high-pressure incidents. You will bring significant experience in security operations, CSIRT or incident response within a large or complex environment, together with the ability to coordinate teams, manage competing priorities and make sound decisions where cyber events may have significant operational, clinical or patient safety implications. Your technical understanding will enable you to provide meaningful oversight of investigations, DFIR practices, security technologies and incident response methodologies without needing to personally lead every investigation.

You will also be an effective coach, communicator and relationship builder who is committed to developing people and creating a positive, learning-focused team culture. You will be confident engaging with analysts, technical specialists, clinical and business leaders, senior executives and external partners, tailoring your communication to the audience and situation. Importantly, you will demonstrate an understanding of Te Tiriti o Waitangi and equity considerations and be able to incorporate these meaningfully into leadership, decision-making and cyber incident response. You will be adaptable, accountable and improvement-focused, with the resilience to provide steady leadership through prolonged or high-impact incidents.

To succeed in this role, you will bring:

• Relevant postgraduate qualification in Cyber Security or a closely related discipline, or equivalent professional experience.
• Recognised cyber security or incident response certification such as SANS GCIH, GMON, GCED, BTLO, CompTIA Security+, CySA or equivalent.
• 3-5+ years' significant experience in Security Operations, CSIRT or incident response within a large, complex or high-stakes environment.
• 3-5+ years' experience leading or coordinating incident response teams, including workflow management, prioritisation, rostering, escalation and operational decision-making under pressure.
• Strong technical knowledge of SIEM, EDR, DFIR and case management technologies, threat actor TTPs and end-to-end cyber incident response methodologies.
• Experience working within structured incident management frameworks such as CIMS, including participation in incident management teams, crisis management groups or comparable environments.
• Demonstrated ability to coach and mentor analysts, support staff wellbeing, manage conflict and communicate effectively with senior, executive and clinical stakeholders.
• Proven ability to drive continuous improvement across playbooks, workflows, tools, automation and documentation, with a meaningful commitment to Te Tiriti o Waitangi and equity.

Working for Health New Zealand

Health New Zealand | Te Whatu Ora is dedicated to ensuring excellent healthcare for the people of New Zealand. We embrace a workforce that is diverse and inclusive so that we are better positioned to understand and service our community. We welcome applications from our diverse Māori, Pacific, disabled, and rainbow communities.

How to Apply

To apply please click "apply now." All applications must be submitted through our online careers' portal by 25 August. If you have any questions about the role, please contact Roshni George at roshni.george@tewhatuora.govt.nz

Whilst Health New Zealand is undergoing change, affected employees will be given preference and priority for this position.