Director of Response, Philippines

About Blackpanda

Somewhere in Manila tonight, a server room is on fire. Not literally — though sometimes it might as well be. A ransomware note is blinking on a managing director's screen in a tower above Ayala Avenue. A family office in Rockwell is locked out of its own ledgers. A trading desk in Bonifacio Global City is running orders on paper. Across the bay in Entertainment City, a hospitality group has just learned its booking system isn't its own anymore. Somewhere — Binondo, Ortigas, Alabang, Quezon City, Cebu — a CIO is staring at the ceiling at three in the morning, wondering who to call.

That call comes to us.

Blackpanda is Asia's premier cyber crisis response firm — Lloyd's of London–accredited, regionally headquartered, and built for one purpose: to walk in when the worst has already happened, and walk out leaving the company still on its feet. We do incident response and digital forensics. That is it. No identity crisis about what we are. We are pure IR, and we like it that way.

Three channels, one operating force. We reach the market in three ways, and every channel feeds the same unit.

• Consulting. Hourly, senior-led engagements for enterprises and board-level matters where complexity, sensitivity, or scale demand our most experienced operators.
• IR-1. Our proprietary fixed-cost subscription is sold through IT channels and underwritten on our own insurance paper. IR-1 puts a real response solution in the hands of mid-market and small companies who have never been able to afford traditional cyber cover — paid up front, before the breach, with our team on the other end of every activation.
• Traditional cyber insurance. Full-stack policies for the mature, board-level buyer, with our response practice on the inside of every claim. Not a panel. Not a vendor. Our own people.

As a Lloyd's coverholder, the revenue arrives before the breach, not after it. Where traditional insurers park that float in markets, we pour ours straight back into the team — into people, training, tooling, and hours on the keyboard against real adversaries. Our gross margins run roughly two times those of traditional IR firms, and every point of that advantage compounds inside the unit.

The Cyber In-Extremis Force. At the centre of everything is the CIF.

Borrowed the term from the special operations world and you'll understand what we mean by it. In extremis describes the moment a situation has moved beyond the tolerance of conventional units. When the building is already burning. When there is no time, no margin, no second chance. In-extremis forces are the no-fail option — who you call when calling anyone else means accepting the loss.

Blackpanda was founded by three former operators of the Commander's In-Extremis Force, one of five CIF teams the United States military positioned around the world, theirs based out of Okinawa. They built this firm because they had served inside the original — and they know what right looks like. How the best are selected. How the best are trained. How the best stand ready when the call comes. They are building the cyber equivalent the only way they know how: same standards, same discipline, same refusal to compromise on who gets to wear the patch.

We set a hard floor under who is allowed in the room. Every responder on the CIF roster holds — or is actively earning — multiple SANS Institute certifications, the most rigorous DFIR qualifications in the field. Network forensics, enterprise cloud, Linux, Windows, adversary tradecraft. The company pays for the coursework. The company pays for the certifications. The bar is not negotiable.

By the end of 2026, Blackpanda expects to field 25 full-time incident responders — by a wide margin the largest pure-IR team in Asia-Pacific and Japan. You want to run with the best? You have to be trained by the best. We do this so that one day there is no question — inside the firm or outside it — about who is the best.

Our Core Values

• Sincerity — If we say we'll do it, it's as good as done. In combat, you have to know your right flank will be there at 0200 when they said they would. The work is the same.

• Unity — Debate fiercely, then commit fully. We all row in the same direction.

• Efficiency — Timing beats speed, precision beats power, leverage beats strength.

• Humility — Humility forms the basis of honor. We listen, then we act, then we listen again.

• Grit — We don't sugarcoat setbacks or bad news. We face challenges head-on and we don't quit when it gets hard.

Our story:

Blackpanda is Asia's leading cyber incident response company, delivering digital emergency response across three integrated channels: IR consulting, IR-1 assurance subscriptions, and Lloyd's of London-underwritten cyber insurance. Each is purpose-built for a different buyer, whether enterprise, mass market, or sophisticated risk-transfer clients, and each stands alone as full incident response. Together, these channels reach the entire commercial market, because our mission is to provide digital emergency response for everyone. Buy all three and they combine into the complete post-attack recovery solution: preparation in advance, response the moment you're hit, and financial recovery paid for by insurance. One local team to help you get ready, respond, and recover.

Our Mission: To provide digital emergency response to everyone.

Our Vision: Accessing cyber incident response is as universally accessible as dialing 9-1-1.

What we are looking for:

Reporting to the VP of Response, the Director of Response leads Blackpanda's Cyber Incident Response practice in the Philippines — growing the local team, owning client relationships, and serving as our senior technical authority on the ground, from Metro Manila to Cebu and beyond.

This is a leadership role for an operator who has lived through real incidents and can bring clarity, calm, and direction when organisations are at their most exposed. You will still take the lead on select engagements where your seniority is required, but your primary job is to scope work, guide consultants, grow the bench, and represent Blackpanda in the Philippine market — in lockstep with the wider regional team.

Blackpanda is a tech-enabled services team. We invest heavily in AI and are constantly pushing to do better, faster, and at scale. You are given freedom to use the approved tools in the team, but you are to take ownership of outcomes. We prefer smart work over hard work, welcome good ideas regardless of where they come from, and have deliberately kept red tape out of the way of innovation.

You will own the Philippines — the team, the clients, the relationships, and the reputation — with the backing of a regional firm purpose-built for cyber crisis. We're not here to check boxes; what matters most is your judgment and the calm authority you bring when others look to you to follow. If you've led teams through real crises and want to build the leading local response practice in the Philippines, we want to talk.

Responsibilities and Duties:

Local Leadership and Team Development

• Grow and retain the Philippines response team — hiring, developing, and building a bench capable of handling the full spectrum of incidents in the local market.
• Mentor consultants in DFIR tradecraft, client communication, and operational discipline; guide them through investigations without taking the keyboard.
• Own the well-being, performance, and progression of the local team, ensuring sustainable workloads in a high-pressure practice.
• Partner with peers in the wider regional team — Singapore headquarters, Hong Kong, Japan, and Malaysia — to share intelligence, align methodology, and ensure consistent quality across the region.

Client Advisory and Engagement Leadership

• Act as senior technical advisor on active incidents — guiding clients through containment, eradication, recovery, and post-incident strategy.
• Advise executives on risk, regulatory exposure, and strategic options as they work to emerge from a difficult situation.
• Lead scoping conversations on new engagements, translating client needs into clear response plans and accurate proposals.
• Maintain trusted relationships with clients, legal counsel, insurers, regulators, and law enforcement throughout the incident lifecycle.

Delivery Oversight and Selective Hands-On Work

• Own delivery quality across Philippine engagements, reviewing findings, reports, and client deliverables before they go out.
• Step into delivery on the most complex, sensitive, or high-profile matters that require senior judgment.
• Lead or coordinate on-site response across Metro Manila and the wider country, including Cebu, Davao, and other key business centres, when an incident demands boots on the ground.
• Guide investigations across Windows, Linux, macOS, and cloud environments, drawing on EDR, SIEM, network, and forensic data.

Regulatory Awareness and Threat Landscape

• Maintain a current view of the Philippines and broader APAC regulatory environment, including the Data Privacy Act of 2012 and the National Privacy Commission's (NPC) 72-hour breach-notification rules, Bangko Sentral ng Pilipinas (BSP) IT risk management and cyber-incident reporting requirements for supervised financial institutions, and the Cybercrime Prevention Act of 2012.
• Track active threat actors, ransomware groups, and sector-specific risks — including to banking, e-wallets and digital payments, BPO, and hospitality — and translate that context into practical guidance for clients.
• Act as the local authority during regulatory conversations and notifications — with the NPC, BSP, SEC, Insurance Commission, DICT, the Cybercrime Investigation and Coordinating Center (CICC), the NBI Cybercrime Division, and the PNP Anti-Cybercrime Group — ensuring clients are well-positioned and well-represented.

External Presence, Brand, and Cross-Functional Collaboration

• Represent Blackpanda at conferences, industry events, and roundtables in the Philippines and the region to support marketing, brand, and pipeline.
• Build a strong personal and firm reputation across the local cyber community through speaking, publishing, and thought leadership.
• Partner with sales and the regional response leadership team — providing technical insight in pre-sales and helping position Blackpanda's capabilities with precision.
  
  

Qualifications and Experience:

Minimum Requirements

• 8+ years of hands-on experience in cyber incident response, digital forensics, or threat intelligence, including substantial time in a client-facing consulting environment.
• 3+ years leading or managing a response, DFIR, or security consulting team, with demonstrated ownership of hiring, mentoring, and performance.
• Track record of leading complex, high-stakes incidents end-to-end — ransomware, BEC, nation-state intrusions, data exposure — including direct engagement with executives, legal, regulators, and insurers.
• Have experience facilitating table top exercises to both technical and non-technical audiences of varied seniority.
• Strong technical foundations across enterprise networks, endpoints, and cloud (Windows, Linux, macOS, AWS / Azure / GCP).
• Working fluency with the modern DFIR toolkit — EDR, SIEM, network forensics, and forensic suites (e.g. Splunk, ELK, SentinelOne, CrowdStrike, Velociraptor, X-Ways).
• Precise, articulate communicator — able to translate complex technical findings into clear, strategic guidance for boardrooms, regulators, and war rooms alike.
• Working knowledge of the Philippine regulatory environment (NPC, BSP, SEC, DICT/CICC) and an informed view of the APAC threat landscape.
• Fluency in English and Filipino, written and spoken.
• Calm, decisive presence under pressure, with proven judgment in ambiguous, high-stakes situations.

Preferred Qualifications

• Certifications such as GCFA, GNFA, GREM, GCIH, OSCP, or equivalent.
• Experience presenting at industry conferences and contributing public thought leadership.
• Established network across the Philippines' cyber, legal, regulatory, law enforcement, and insurance communities.
• Cebuano or another regional language, in addition to English and Filipino.
• Prior exposure to OT/ICS or critical infrastructure environments (e.g. energy, telecommunications, transport).
  
  

What we offer:

• 40 days paid leave per year inclusive of public holidays, which may be taken at the discretion of the employee subject to compliance with our Leave Policy and the approval of their manager.
• Limited Work From Anywhere policy allotment, allowing for work from alternate locations contingent upon coverage provided by teammates and approved by manager for 5 days per quarter.
• Enrolment in the company's comprehensive corporate health plan that includes a large direct billing network for medical and dental coverage.
• Opportunities for inter-office travel, including a required annual week-long Tribe Onsite meet-up and quarterly week-long leadership Offsites.
• $5000 USD/year for professional training budget contingent on approval from manager with 12-month retention requirement
• Competitive base salary with performance-based variable compensation tied to market results, plus equity participation in Blackpanda's growth.
  
  

Declamation:

Candidates who successfully pass the Interview stage may be required to complete a Case Study, used to evaluate their technical knowledge and application of their skills in practical scenarios relevant to the role.

Blackpanda is committed to building a culturally diverse company, and we value a broad set of opinions in our team. As we grow, we are looking to build a team with a range of viewpoints at its core, and we encourage applications from minority candidates and all genders however you identify (X/F/M).

Blackpanda does not accept unsolicited resumes from recruitment agencies. We will not be responsible for any fees related to unsolicited candidates submitted by recruiters with whom we have not established explicit, written agreements for our job vacancies. By submitting any candidate information, recruiters agree to forfeit any claim to fees should their candidate be hired without an established agreement with Blackpanda.