Director, Digital Forensics and Incident Response

Director DFIR (Digital Forensics and Incident Response)

About TMHCC

Tokio Marine HCC (TMHCC) brings 50 years of service to the specialty insurance industry, today offering over 100 products to commercial customers in 180 countries around the world.  Every policy we write is special, enabling our clients to do amazing things. From insuring the crops that feed us to the rock concerts that entertain us, to rescuing international travelers in trouble.

Organic growth and over 60 successful acquisitions have grown our 2023 Gross Written Premium (GWP) to over $7.5 Billion. Our workforce has grown to 4,300 worldwide … big, but not so big that you cannot make a difference. Our Good Company values, including integrity, empowerment, and commitment to customer service, and a culture of innovation, communication, and collaboration make TMHCC a great place to work.

What we offer: 

• Competitive salary and employee benefit package 

• Strong learning culture 

• Growth perspectives 

• 6% 401K match 

• 20 days of PTO and 2 Floating Days 

• Paid parental leave

• An opportunity to love what you do

About the role:

Shape the future of TMHCC-CPLG by creating and inspiring a team of DFIR specialists, driving excellence in digital forensics, incident response, and threat mitigation for TMHCC-CPLG insureds. Ultimately, develop and implement strategic initiatives to continue to enhance the teams DFIR capabilities, ensuring swift and effective response to cyber incidents. Oversee all aspects of digital forensic investigations for insureds, including managing incident response operations, providing expert technical guidance, developing strategic response plans, and ensuring the TMHCC-CPLG stays abreast of emerging cyber threats, while often acting as the primary client contact for incidents. 

Key Responsibilities Intro

Relying on broad experience and judgment, this role is accountable for accomplishing the following responsibilities

Key Responsibilities

• Leadership and Team Management:

• Recruit, develop, and manage a high-performing DFIR team, including technical specialists in areas like malware analysis, Managed Detection and Response, digital evidence collection, extortion negotiations, and recovery. 

• Assign tasks, delegate responsibilities, and provide mentorship to team members. 

• Develop and maintain operating procedures and best practices for DFIR team. 

• Build and maintain insured/carrier relationships.

• Invest in career development and provide mentorship to a team that will grow with time and experience.  

• Foster a culture of innovation, continuous learning, and skill development within the DFIR team. 

• Client Management and Engagement:

• Act as the “Incident Commander” for insureds or their representatives during cyber incidents, providing clear communication, recovery direction, and/or updates on investigation progress. 

• Conduct scoping calls with clients to understand the disruption, develop a roadmap to resolve the cyber security event, and provide initial triage to contain the threat.

• Understand insured needs and tailor strategies to address specific business risks and compliance requirements. 

• Communicate complex cybersecurity concepts internally and externally.

• Build strong insured relationships and maintain trust through effective communication and timely delivery of investigation results. 

• Incident Response Operations:

• Lead incident response activities during cyber security breaches, including initial triage, threat assessment, containment, eradication, and recovery phases. 

• Develop and maintain comprehensive incident response plans aligned with industry best practices. 

• Conduct post-incident analysis to identify root causes and implement preventive measures to mitigate future risks. 

Technical Experience

• Stay informed about emerging cyber threats and technologies, including Tactics Techniques and Procedures and Indicators of Compromise associated with specific cyber crime syndicates. 

• Understand and be aware of changes in technology as it relates to forensic data for review, or forensic techniques available to provide the best combination of speed and accuracy in forensic findings.

• Provide expert technical guidance on digital forensics methodologies, evidence collection, analysis, and reporting. 

• Conduct complex digital forensic investigations, including analysis of system logs, network traffi