Phishing Incident Response Simulation

I’m rolling out a focused phishing exercise to measure— and improve— our incident-response muscle. The scope is tight: a small group of fewer than twenty staff drawn from our IT and HR departments will be the only recipients. I need a specialist who can design realistic, multi-stage phishing messages, launch them, track every interaction, and then translate the raw data into clear insights. The priority is not basic awareness training but gauging how quickly and effectively people report a suspicious email, whether escalation paths work, and how support tooling (SIEM, ticketing, email gateways) reacts. A short timeline and minimal disruption are essential; the whole campaign should feel natural to participants while remaining fully controlled and ethical. Deliverables • Scenario plan with lure themes, payload logic and success criteria • Stealth deployment to the defined user list (IT & HR only) • Live metrics dashboard or CSV export showing opens, clicks, credential submissions and report times • Post-simulation debrief: executive summary, detailed findings, and concrete remediation steps I’m comfortable if you use platforms such as GoPhish, KnowBe4, or a custom script—just outline your preferred stack up front. All artifacts, including phishing templates and server code, become our property at hand-off. To be considered, briefly describe a comparable campaign you’ve run, note any compliance safeguards you add (e.g., no real data harvesting), and confirm you can start within the next week.