Manager, Cyber Incident Response

This is a fully remote position, open to applicants in Florida.

📋 Description

• Oversee the operations of Incident Response, which includes prioritization, resource allocation, shift coverage, tooling requirements, workflow management, and escalation processes.

• Ensure compliance with the NBCUniversal Incident Response Plan and associated procedures.

• Manage cyber incidents throughout the enterprise from the stages of escalation and validation to containment, remediation, recovery support, and closure.

• Act as the Incident Handler or Incident Commander for critical incidents.

• Coordinate response efforts with affected businesses, technical owners, and partner teams.

• Serve as the managerial escalation point for potential cyber incidents, needs of responders, and leadership decisions.

• Participate in the on-call manager rotation for cyber incident escalation and management in a 24/7/365 global environment.

• Supervise operational performance across shifts, ensuring prioritization, ticket ownership, escalation discipline, and adherence to standards.

• Review shift handovers, monitor queue health, and assess open incidents for continuity and accountability.

• Uphold standards for event and incident documentation, case-management requirements, KPIs, and process adherence.

• Observe operational metrics and trends, identify gaps, and implement enhancements.

• Lead the governance of response processes, playbooks, tuning requests, automation opportunities, and technical procedures.

• Drive the growth, enhancement, and strategy of the Incident Response program.

• Collaborate strategically with Information Security Officers, business stakeholders, and security and technology teams.

• Develop and sustain process documentation, ownership, review cycles, approvals, and change management.

• Lead, mentor, and nurture Incident Response personnel.

• Generate and present monthly metrics and executive reports.

• Communicate incident status, operational issues, decisions, and risks to business VIPs and senior leadership.

⛳️ Requirements

• A Bachelor’s degree in an information technology-related field and/or equivalent professional experience.

• A minimum of seven years of experience in cybersecurity or investigations.

• At least four years of experience in Incident Response, a Security Operations Center, threat intelligence, or a related area.

• Previous leadership experience in incident response operations, managing cybersecurity personnel, or coordinating complex incidents.

• Comprehensive knowledge of cyber threats, adversarial techniques, response procedures, network and enterprise architecture, and threat detection.

• Capability to make evidence-based decisions in uncertain situations and to coordinate response activities across various teams.

• Willingness to thrive in a fast-paced, high-demand environment that may necessitate nonstandard working hours.

• Availability to support employee development and manage escalations in a 24/7/365 global context.

• Strong organizational skills with the ability to handle multiple workstreams, incidents, and escalation paths.

• Proficient understanding of web application architecture, networking, identity management, endpoint security, email security, and cloud services.

• Experience with host-based and network-based forensic tools and analysis techniques.

• Familiarity with MITRE ATT&CK, the Cyber Kill Chain, the Diamond Model, and NIST incident response guidelines.

• Experience applying security concepts in AWS, Azure, and/or Google Cloud Platform environments.

• Knowledge of EDR, XDR, SOAR, case management, and response automation tools.

• Background in developing or enhancing incident-management processes, playbooks, metrics, or automation.

• Outstanding written and verbal communication skills, including the ability to brief technical professionals, business stakeholders, and senior executives.

• Strong leadership, coaching, interpersonal, and problem-solving abilities.

• Relevant security certifications such as GCIH, GCFA, GNFA, GCIA, CISSP, or equivalent are preferred.

• Prior experience managing a Cyber Incident Response, Security Operations Center, or a related cyber defense function is preferred.

• Experience supporting incident response or SOC operations for a large, complex, or global enterprise is preferred.

• Practical familiarity with endpoint detection and response, forensic tools, network analysis, email security, and cloud security technologies is preferred.

🏝️ Benefits

• Medical, dental, and vision insurance.

• 401(k) plan.

• Paid time off.

• Tuition reimbursement.

• Employee discounts and various perks.

• Eligibility for bonuses.