Incident Response Program Lead

Role overview Lead the development and day-to-day operation of a security incident response program while overseeing a managed security service provider. Coordinate response to security and compliance incidents, improve operational readiness, and advise security leadership and cross-functional partners. The role may include participation in an escalation or on-call rotation.

Responsibilities - Maintain and improve incident response policies, plans, playbooks, severity levels, escalation paths, communications, and documentation. - Lead incidents from investigation and containment through recovery, evidence preservation, and post-incident follow-up. - Govern the managed security provider’s performance, service integration, escalation processes, detection coverage, response times, and contractual commitments. - Work with internal teams and the provider to improve alerts, detection rules, investigations, log coverage, threat intelligence, and response automation. - Run tabletop exercises and readiness testing; document lessons and track corrective actions to completion. - Report on incident trends, response metrics, provider performance, control gaps, and issues needing leadership attention. - Support risk assessments, audits, policy and control reviews, vendor assessments, and remediation planning.

Requirements - At least five years of information security experience, with substantial work in incident response, security operations, or detection and response. - Experience coordinating incidents across technical and business teams and understanding the full response lifecycle. - Experience developing, maintaining, and testing incident plans, procedures, or playbooks. - Experience working with a managed security provider, MDR provider, SOC, or similar partner. - Working knowledge of SIEM, endpoint and cloud security, vulnerability management, identity and access management, network security, and log-based investigations. - Experience with cloud environments, particularly AWS and multi-account architectures. - Familiarity with incident response frameworks such as NIST or SANS, and security compliance programs such as PCI DSS, SOC 2, or ISO 27001.

Benefits and work setup - Remote within the continental United States, with work aligned to Central Time business hours. - Compensation listed up to $155,000, alongside health coverage, a 401(k) with company matching, paid time off, and eligible paid parental leave. - Annual professional development allowance.