Incident Response Program Lead

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of and enhance the Security Incident Response program, which encompasses policies, plans, playbooks, severity classifications, escalation criteria, communication protocols, and incident documentation.

• Direct security and compliance incident responses across both technical and business teams, covering investigation, containment, eradication, recovery, evidence preservation, and post-incident activities.

• Manage the governance and performance of the Managed Security Service Provider, including onboarding, service integration, escalations, service reviews, contractual obligations, SLAs, detection coverage, response times, quality standards, and metrics.

• Collaborate with the MSSP and internal teams to enhance alert quality, detection rules, investigation processes, log coverage, threat intelligence, and response automation.

• Hold the MSSP accountable for both contractual and operational performance; monitor deficiencies and ensure corrective actions are completed.

• Facilitate incident response tabletop exercises and necessary testing; document lessons learned and track remediation efforts.

• Ensure incident response readiness by maintaining coverage, escalation capabilities, responder training, and coordination with internal responders and the MSSP.

• Provide reports on incident trends, response metrics, recurring issues, MSSP performance, control gaps, and concerns for leadership.

• Assist the Information Security Manager with risk assessments, compliance activities, audit preparations, policy development, control reviews, vendor assessments, and remediation planning.

• Provide guidance to leadership and technical teams on security events, emerging risks, operational priorities, and suggested actions.

• Engage in an incident escalation or on-call rotation as needed.

⛳️ Requirements

• A minimum of five years of experience in information security, with significant experience in incident response, security operations, detection and response, or a related field.

• Proven experience in leading or coordinating security incidents among technical and business teams.

• In-depth understanding of the complete incident response lifecycle.

• Experience in developing, maintaining, and testing incident response plans, procedures, and playbooks.

• Familiarity with working alongside an MSSP, MDR provider, SOC, or other managed security partners.

• Proficient knowledge of security monitoring, SIEM, endpoint security, cloud security, vulnerability management, identity and access management, and network security.

• Experience utilizing logs and technical evidence to investigate security incidents.

• Hands-on experience with cloud environments, especially AWS, and multi-account cloud architectures.

• Understanding of NIST CSF, NIST SP 800-61, and the SANS incident response methodology.

• Experience supporting security/compliance frameworks such as PCI DSS, SOC 2, or ISO 27001.

• Excellent written and verbal communication skills.

• Capability to work independently, prioritize tasks, and make informed decisions in high-pressure or time-sensitive situations.

• Experience leading tabletop exercises involving executive leadership, Legal, Compliance, Engineering, and external service providers.

🏝️ Benefits

• Comprehensive health insurance.

• 401(k) plan with company matching.

• Generous paid time off.

• Up to eight weeks of paid parental leave for eligible caregivers.

• Remote-first work environment with flexibility and autonomy.

• Annual allowance for professional development.

• Access to tools, autonomy, and support necessary for success.

• Reasonable accommodations for job applications, interviews, essential job functions, and employment benefits and privileges.