Incident Response Manager

Job description

**This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for an Incident Response Manager based in the United States.** The Incident Response Manager will lead the coordination of security and data-related incidents, ensuring investigations progress efficiently from initial detection through resolution and closure. This role serves as a central point of contact for technical teams, legal experts, HR, security professionals, and business stakeholders during time-sensitive investigations. You will oversee incident tracking, facilitate clear communication, and ensure that remediation actions are completed effectively. Working across multiple security domains, including data loss prevention, privacy, identity management, fraud, and unauthorized access, you will help strengthen organizational resilience and compliance. The position also contributes to improving incident response procedures, reporting practices, and business continuity preparedness. This is an excellent opportunity for an experienced security professional who excels at cross-functional coordination, sound decision-making, and maintaining clarity under pressure. ### Accountabilities - **Incident Coordination and Investigation:** Coordinate security and data incidents from initial detection through resolution, supporting timely triage, severity assessment, investigation progress, and closure across a range of incident types, including data breaches, privacy events, fraud, identity concerns, unauthorized access, and data exposure. - **Cross-Functional Stakeholder Management:** Serve as the primary coordination point for Legal, HR, IT, Global Security, forensic investigators, Data Loss Prevention (DLP), and business teams. Ensure stakeholders remain informed, responsibilities are clear, and investigations progress without unnecessary delays or conflicting communications. - **Executive Communication and Reporting:** Prepare timely incident updates, executive briefings, and management reports that clearly communicate incident status, risks, remediation progress, and emerging trends to support informed decision-making. - **Incident Tracking and Remediation:** Maintain the incident tracking system and ensure every action item, remediation measure, and follow-up task has an assigned owner and deadline. Monitor progress, resolve coordination bottlenecks, and drive outstanding actions through completion. - **Process Improvement and Governance:** Maintain and enhance incident response playbooks, procedures, escalation pathways, and reporting standards. Support post-incident reviews, document lessons learned, and implement improvements to strengthen response effectiveness. - **Security and Business Continuity Integration:** Collaborate with Data Loss Prevention, Governance, Risk and Compliance (GRC), and Business Continuity Planning (BCP) teams to align incident response practices with broader security and resilience initiatives. Contribute to ransomware simulations and business continuity exercises. - **Regulatory and Compliance Support:** Help ensure incident handling aligns with applicable privacy, regulatory, and compliance obligations in collaboration with Legal and Compliance stakeholders. - **Operational Readiness:** Identify gaps in incident coordination, communication, escalation, and remediation processes, recommending practical improvements while remaining available to support urgent incidents outside standard business hours when necessary. ## Requirements - **Professional Experience:** At least 5 years of relevant experience in incident response, security operations, governance, risk and compliance, or a related security coordination function, preferably within a large organization or consulting environment. - **Education:** A bachelor's degree is required, preferably in Information Security, Information Technology, Information Systems, or a related discipline. - **Incident Management Expertise:** Demonstrated experience coordinating investigations or incidents involving multiple teams, stakeholders, and competing priorities, with a working knowledge of incident response frameworks and established security practices. - **Security Knowledge:** Familiarity with security domains such as data loss prevention, identity and access management, privacy incidents, fraud investigations, and unauthorized access. - **Communication Skills:** Excellent written, verbal, and presentation skills, with the ability to communicate complex incident details clearly and calmly to both technical teams and executive audiences. - **Organization and Execution:** Strong project coordination and organizational skills, including the ability to manage multiple concurrent incidents, track action items, maintain accurate records, and ensure timely follow-through. - **Analytical Judgment:** Ability to assess incident information, identify risks and recurring patterns, synthesize data, and prepare meaningful reports that support leadership decisions. - **Resilience and Adaptability:** Demonstrated ability to remain composed under pressure, exercise sound judgment in sensitive situations, and adapt to changing priorities and urgent requests. - **Collaboration:** Strong interpersonal skills and the ability to coordinate effectively across departments, organizational levels, and geographically distributed teams. - **Availability:** Flexibility to support incident response activities outside standard business hours when required. **Preferred qualifications:** - Security certifications such as GCIH, GCFA, CISM, CISSP, or equivalent credentials. - Experience with case management and incident tracking tools such as ServiceNow, Jira, or Azure DevOps (ADO). - Familiarity with DLP systems, identity and access management controls, and privacy or fraud investigation practices. - Experience preparing incident metrics, dashboards, and executive-level reporting. - Strong analytical problem-solving skills, including the ability to translate incident data into actionable recommendations. - Experience collaborating with distributed teams across multiple time zones. ## Benefits - **Competitive base salary:** Estimated annual base salary of **$140,000–$190,000**, depending on experience, qualifications, certifications, and other relevant factors. - **Annual incentive compensation:** Eligibility for an annual performance-based incentive program, with estimated total compensation, including incentive opportunities, ranging from **$168,000 to $228,000**. - **Healthcare coverage:** Medical, dental, and vision insurance options. - **Wellness programs:** Access to employee wellness initiatives and support programs. - **Retirement and financial benefits:** Access to eligible retirement and financial benefit plans. - **Paid time off:** Paid leave and other applicable employee benefits, subject to plan eligibility. - **Professional development:** Opportunities to strengthen incident response expertise, collaborate with experienced professionals, and contribute to enterprise-wide security initiatives. - **Remote work arrangement:** The position is listed as remote, with the role associated with the Chicago location. - **Career impact:** An opportunity to strengthen incident management capabilities, improve security governance, and contribute to organizational resilience in a collaborative, cross-functional environment.