Bsides Cymru 2025

Beyond the Playbook: What It Really Takes to Excel as an Incident Responder
2025-10-17 , Tramshed Tech

Technical tool knowledge isn't enough in incident response. This talk reveals what separates exceptional responders from the rest: understanding the 'why' behind forensic evidence and mastering the soft skills that matter when executives are panicking. Discover the skills that truly count when organisations face their worst moments.


In incident response, the difference between competence and excellence isn't found in certifications or tool proficiency alone. This session, delivered by an experienced IR hiring manager from UK critical infrastructure, explores the technical depth and soft skills that hiring managers seek but rarely find.
On the technical side, exceptional responders understand why forensic artefacts exist and how to leverage them when standard tools aren't available. Rather than simply following playbooks, they grasp the underlying system behaviours that make evidence collection possible, enabling them to adapt and find alternative data sources during complex investigations.
Equally crucial are the soft skills that determine success under pressure. The ability to project calm authority whilst briefing panicked executives, communicate complex findings clearly, and avoid unproductive investigation paths separates good responders from great ones. The talk includes practical techniques for maintaining focus and delivering actionable intelligence during high-stress incidents.
Whether you're breaking into incident response or seeking to elevate your current practice, this session provides actionable insights for immediate skill development and long-term career progression in this demanding field.

James is a Chartered Incident Response Professional with extensive expertise in Digital Forensics and Incident Response (DFIR). Certified by SANS, he brings over nine years of specialised experience to the field, having conducted both criminal and civil forensic investigations across public and private sectors.
In his current role, James leads security operations and incident response investigations for Bridewell's diverse client portfolio. His expertise spans critical national infrastructure, finance and hospitality industries, serving clients throughout the UK and US.