Manager, Incident Response

Role Summary

What you will do

• Lead and develop squads of analysts across CIRT; set clear expectations, provide coaching and feedback, support career development, and build an inclusive, high-performing team culture.
• Own day-to-day CIRT operations across multiple squads, ensuring appropriate staffing, coverage, workload balancing, prioritization, and service-level performance for concurrent customer engagements.
• Provide senior technical leadership and act as Incident Commander for complex or high-severity engagements, coordinating investigation, containment, eradication, recovery, and customer communications through to resolution.
• Establish and maintain operational and investigative quality standards, ensuring teams follow approved processes and playbooks and that engagement documentation, case reviews, and post-incident actions are complete and accurate.
• Use engagement, quality, response-time, capacity, and customer-outcome metrics to identify trends, manage performance, inform resource planning, and drive measurable improvements across the function.
• Build operational readiness by maintaining skills coverage, onboarding and training plans, incident exercises, tooling needs, and playbook updates for a fast-changing threat landscape.
• Serve as a senior escalation point for customer concerns, material findings, delivery risks, and resource conflicts, translating complex technical issues into clear updates and actionable decisions for technical and executive stakeholders.
• Partner cross-functionally with Threat Intelligence, the Security Operations Center, Detection Engineering, Product, and other teams to close detection and response gaps and strengthen MDR’s overall response capability.
• Drive continuous improvement and standardization by turning incident lessons, analyst feedback, and operational data into improved workflows, automation opportunities, training, and service enhancements.

What will you bring

Essential: 

• 7+ years of experience in cybersecurity operations, incident response, digital forensics, or a related discipline, including at least 2 years leading people, teams, or operational functions.
• Demonstrated experience managing incident response operations across multiple concurrent engagements, with responsibility for staffing, prioritization, service-level expectations, and customer outcomes.
• Strong technical background in endpoint, network, and cloud security, with proven ability to investigate indicators of compromise, determine scope and root cause, and direct containment, eradication, and remediation efforts.
• Experience serving as an Incident Commander or senior technical escalation point during high-pressure incidents, with the judgment to make timely risk-based decisions and communicate clearly with technical and executive stakeholders.
• Proven people-leadership experience, including coaching, performance management, career development, hiring or onboarding, and building effective teams through constructive feedback and accountability.
• Experience using operational metrics, quality reviews, and customer feedback to identify performance or process gaps and deliver practical improvements in a security operations or managed services environment.
• Deep understanding of attacker tools, tactics, and procedures, including persistence, lateral movement, credential theft, ransomware, and defense evasion; working knowledge of the MITRE ATT&CK framework.
• Excellent written and verbal communication skills, strong analytical and troubleshooting ability, and a degree in Information Technology, Computer Science, or a related field; or relevant, commensurate work experience.

Desired: 

• Advanced cybersecurity certifications preferred (e.g., GCFE, GCFA, GCIH, CISSP, or similar).
• Experience leading distributed, global, or 24x7 incident response or security operations teams, including participation in an on-call or leadership escalation rotation.
• Experience with SIEM, EDR, forensic collection, and threat intelligence platforms, together with practical use of OSQuery, SQL, PowerShell, KQL, CyLR, Velociraptor, or comparable tools.
• Experience developing incident response playbooks, training programs, tabletop exercises, or other readiness and capability-building initiatives.
• Natural curiosity, adaptability, and a passion for continuous learning, service improvement, and developing the next generation of incident response professionals.