Team Lead
Definition
The person who owns the incident response process during an active incident. The team lead coordinates analyst tasks, manages escalation to leadership, makes containment decisions, and ensures the post-incident review is completed. This is a command and coordination role, not primarily a technical one.
- Context
- Computer Security Incident Response Team
- Role type
- Command and coordination, not primarily technical
- Responsibilities
- Task coordination, escalation, containment decisions
- Also owns
- Post-incident review completion
Common questions
Why is the team lead role described as command rather than technical?+
The team lead's core job is decision-making and coordination under time pressure, such as deciding when to escalate to leadership or authorize containment actions that could affect business operations, rather than performing forensic analysis or malware reverse engineering, which is done by technical analysts on the team.
Can the technical lead and team lead be the same person on a small team?+
In a small organisation the roles are sometimes combined out of necessity, but larger or more mature teams typically separate them so the person managing stakeholder communication and business-impact decisions is not simultaneously buried in hands-on technical analysis.
Related terms
- CSIRT
- Computer Security Incident Response Team. The organisational unit responsible for preparing for, detecting, coordinating, and resolving security incidents. Sometimes called CERT (Computer...
- FIRST
- Forum of Incident Response and Security Teams. A global membership organisation that sets standards for CSIRT capability and facilitates trusted information sharing...
- Legal Liaison
- The CSIRT role responsible for advising on legal obligations during an incident: evidence preservation requirements, breach notification deadlines, law enforcement engagement, and...
- National CERT
- A government-operated or government-designated team responsible for coordinating cyber incident information at the national level. Examples include CERT-In (India), CISA (US), NCSC...
- Retainer Agreement
- A contract between an organisation and an external IR firm that guarantees a defined response time and service scope in exchange for...