Job Summary:The Incident Response Manager leads the response team and owns execution of an established incident response capability across GFC US companies. The manager serves as Incident Commander, directs internal responders and external forensic specialists, assures investigation quality, and communicates with leadership, stakeholders, and governance bodies.
Essential responsibilities:- Hire, coach, develop, and manage the performance of three incident responders
- Serve as Incident Commander through investigation, containment, eradication, recovery, and closure. Establish priorities, assign owners, manage dependencies, and track actions to completion
- Coordinate response across companies with separate business leaders, technical teams, and approval boundaries. Integrate external specialists into a unified response
- Provide technical oversight and quality assurance for findings, evidence handling, and response recommendations. Direct third-party forensic work; routine hands-on analysis is not expected of the manager
- Provide clear technical, business, and executive updates covering incident status, business impact, risk, response options, and decisions required
- Recommend necessary containment and recovery actions based on evidence and business risk. Operate within delegated authority and obtain required approvals
- Maintain a 247 response capability through coverage planning, escalation procedures, and team readiness. Provide after-hours incident command when escalated
- Maintain and improve plans, playbooks, exercises, and response measures. Lead post-incident reviews and drive corrective actions to closure
Required skills and experience:- 8+ years of cybersecurity experience, including 5+ years in incident response and 2+ years of formal people management. These periods may overlap
- Demonstrated success hiring and managing direct reports, developing staff, setting expectations, and managing performance
- Proven command of significant, complex cybersecurity incidents through resolution, with sound decisions under pressure and uncertainty
- Experience coordinating incidents across multiple companies or business units with separate leadership teams, technical teams, and approval boundaries
- Ability to structure response work, resolve impediments, track dependencies, and deliver timely, clear executive briefings and written reports
- Technical depth sufficient to direct investigations and challenge recommendations involving endpoint and server compromise, ransomware, identity and account compromise, Active Directory and Entra ID, cloud and Microsoft 365, network investigations, lateral movement, and data exfiltration
- Strong understanding of digital forensics, evidence preservation, and chain of custody; experience interpreting findings from EDR/XDR, SIEM, forensic tools, and incident case-management systems
- Demonstrated ability to improve response frameworks, playbooks, exercises, performance measures, and post-incident processes; sound judgment in escalation, delegated authority, and sensitive communications
Salary range $160,000 to $190,000. Ultimate salary offered will be based on factors such as applicant experience and geographic location. Our company offers a competitive benefits package and bonus eligibility on top of base.
