Senior Manager, Information Security, CSIRT

Incident Response Leadership & Operational Execution

• Lead the CSIRT function responsible for coordinating response to significant cyber security incidents, including triage, scoping, containment, eradication, recovery, and post-incident improvement.

• Ensure response activities are timely, well-documented, evidence-based, and aligned to enterprise incident management expectations and risk priorities.

• Serve as a senior technical and operational escalation point during high-severity incidents, supporting executive-ready updates and decisive response actions.

• Partner closely with CSOC to ensure alerts escalated to CSIRT are actionable, appropriately enriched, and supported by clear investigative expectations.

• Collaborate with Detection Engineering to convert incidentobservationsinto higher-fidelity detections, tuning opportunities, and response automation.

• Work with Protect Threat Intelligence and ASR to incorporate adversary behavior, exposure context, and threat models into response priorities and containment strategies.

  FIM, Privacy, Insider, and Cross-Domain Incident Inputs

  • Support integration of cyber, privacy, fraud, insider, and other relevant incident inputs into the broader incident response model when events may indicate a material cyber risk or require escalation.

  • Ensure CSIRT contributes clear technical analysis and response recommendations when incidents are elevated through formal incident management channels.

  • Maintain repeatable handoff, escalation, and documentation practices across cross-functional stakeholders.

  Technical Investigation, Forensics & Malware Analysis

  • Oversee technical investigations across endpoint, cloud, identity, network, SaaS, and application environments, ensuring investigative rigor and reproducible analysis.

  • Guide use of digital forensics, malware analysis, log analysis, and threat hunting techniques to determine scope, root cause, persistence, lateral movement, and business impact.

  • Validate containment and recovery actions through evidence, telemetry, and control effectiveness checks.

  ​Playbooks, Automation & Response Engineering

  • Drive development and continuous improvement of response playbooks, decision trees, automation, enrichment, and orchestration that improve response speed and consistency.

  • Partner with platform, automation, and engineering teams to integrate CSIRT workflows with SIEM, SOAR, endpoint, identity, cloud, and case management capabilities.

  • Use lessons learned from incidents, tabletop exercises, and control validation to strengthen repeatability and reduce operational friction.

  Governance, Metrics & Capability Maturity

  • Establish operational metrics for CSIRT effectiveness, including time-to-triage, time-to-contain, incident quality, repeat findings, and remediation follow-through.

  • Contribute to incident management standards, procedures, reporting, audit response, and regulatory readiness activities related to cyber incident response.

  • Translate CSIRT outcomes into risk-based insights that inform leadership decisions, investment priorities, and enterprise resilience improvements.

  People, Strategy & Talent Development

  • Lead, coach, and develop a high-performing incident response team aligned to TDEO’s intelligence-led operating model.

  • Set the CSIRT capability roadmap in alignment with Fusion priorities, evolving adversary tradecraft, regulatory expectations, and enterprise risk outcomes.

  • Promote a continuous improvement culture that values technical depth, operational discipline, collaboration, and calm execution under pressure.

  Required Qualifications

  • Prior people leadership experience in incident response, security operations, threat investigation, digital forensics, or a related cybersecurity function.

  • 8+ years of experience in cybersecurity, with deep experience leading or performing cyber incident response in complex enterprise environments.

  • Strong understanding of the incident response lifecycle, including triage, scoping, containment, eradication, recovery, root cause analysis, and post-incident improvement.

  • Hands-on or leadership experience with SIEM, SOAR, EDR/XDR, identity, cloud security, network telemetry, case management, and investigative tooling.

  • Working knowledge of digital forensics, malware analysis, threat hunting, threat intelligence, and adversary tactics, techniques, and procedures.

  • Experience partnering with legal, privacy, fraud, insider threat, technology operations, and business stakeholders during sensitive or high-impact cyber events.

  • Ability to communicate complex technical issues clearly to senior leaders and translate response actions into risk-based business outcomes.

  Preferred Qualifications

  • Experience operating within a Fusion-style, cross-domain security model integrating intelligence, detection, response, and exposure management.

  • Experience leading response to ransomware, credential compromise, cloud/SaaS compromise, third-party compromise, data exposure, or insider-related cyber investigations.

  • Experience developing response automation, playbooks, tabletop exercises, purple-team learnings, or incident-driven detection improvement processes.

  • Relevant certifications such as GCIH, GCFA, GCIA, GNFA, CISSP, CISM, or cloud security certifications are preferred.