Essential skills for working in incident response | Interview with David Cannings (Director, PwC UK)

### Overview In this interview, David Cannings, a Director at PwC in the United Kingdom, shares insights into the essential skills and realities of working in incident response. Cannings outlines his professional background—from studying networking at university and supporting UK critical infrastructure breach responses to working with global technical specialists and transitioning to PwC. His role spans the entire lifecycle of incident response cases, from early discussions with clients suspecting an incident, tracking technical investigation progress, to presenting findings, with an overarching focus on clients, business context, and broader industry impact.

### Key Topics - **Career Path and Daily Responsibilities**: Managing end-to-end incident response engagements across diverse organizations, ranging from early-stage startups to multinational critical infrastructure providers handling power and water. - **Navigating Uncertainty and High-Stress Situations**: Dealing with clients in crisis mode, managing executive expectations, and communicating when definitive technical evidence is unavailable. - **Essential Skillsets Beyond Technical Prowess**: The necessity of balancing deep technical analysis with curiosity, persistence, project coordination, and strong business communication across multiple corporate departments. - **Industry Trends and Evolving Threats**: Adapting to increased regulation, closer alignment with legal counsel, ongoing ransomware campaigns, and the threat of sensitive data leaks impacting personal privacy and national security. - **Committee Objectives and Community Collaboration**: Modernizing CREST incident response examinations and fostering strong partnerships with stakeholders like the National Cyber Security Centre (NCSC).

### Technical Details - **Investigative Mindset**: Technical breakthroughs often stem from being inquisitive, challenging foundational assumptions, and persistently tracking down minor anomalies that look unusual at first glance. - **End-to-End Investigation Lifecycle**: Engaging at the initial scoping phase, monitoring forensic and analytical progress during the crisis, and compiling and presenting conclusive factual debriefs. - **Client and Legal Dynamics**: Investigations frequently face demands for absolute certainty from clients and legal teams. Because certainty is not always technically feasible, responders must clearly articulate established facts and deliver difficult truths when evidence is lacking. - **Business Context Sensitivity**: Investigations operate within broader commercial contexts, such as pending mergers or acquisitions, which fundamentally shape how executive leadership responds to incidents.

### Takeaways - **Cultivate Both Technical and Soft Skills**: While technical capabilities are fundamental, success in incident response relies heavily on project coordination, stakeholder empathy, and translating complex findings into language appropriate for audiences ranging from IT operations and HR to the CEO and CFO. - **Prepare for Increasing Legal and Regulatory Scrutiny**: Heightened regulatory compliance and collaboration with legal teams require incident responders to adapt workflows and emphasize verifiable facts. - **Support Standards and Cross-Industry Collaboration**: Collaboration among incident response firms, alignment with government bodies such as the NCSC, and maintaining up-to-date CREST certification standards are critical to safeguarding both personal data and national critical infrastructure.