Senior Manager, Information Security, CSIRT

Incident Response Leadership & Operational Execution

• Lead the CSIRT function responsible for coordinating response to significant cyber security incidents including triage scoping containment eradication recovery and post-incident improvement.

• Ensure response activities are timely well-documented evidence-based and aligned to enterprise incident management expectations and risk priorities.

• Serve as a senior technical and operational escalation point during high-severity incidents supporting executive-ready updates and decisive response actions.

• Partner closely with CSOC to ensure alerts escalated to CSIRT are actionable appropriately enriched and supported by clear investigative expectations.

• Collaborate with Detection Engineering to convert incidentobservationsinto higher-fidelity detections tuning opportunities and response automation.

• Work with Protect Threat Intelligence and ASR to incorporate adversary behavior exposure context and threat models into response priorities and containment strategies.

  FIM Privacy Insider and Cross-Domain Incident Inputs

  • Support integration of cyber privacy fraud insider and other relevant incident inputs into the broader incident response model when events may indicate a material cyber risk or require escalation.

  • Ensure CSIRT contributes clear technical analysis and response recommendations when incidents are elevated through formal incident management channels.

  • Maintain repeatable handoff escalation and documentation practices across cross-functional stakeholders.

  Technical Investigation Forensics & Malware Analysis

  • Oversee technical investigations across endpoint cloud identity network SaaS and application environments ensuring investigative rigor and reproducible analysis.

  • Guide use of digital forensics malware analysis log analysis and threat hunting techniques to determine scope root cause persistence lateral movement and business impact.

  • Validate containment and recovery actions through evidence telemetry and control effectiveness checks.

  Playbooks Automation & Response Engineering

  • Drive development and continuous improvement of response playbooks decision trees automation enrichment and orchestration that improve response speed and consistency.

  • Partner with platform automation and engineering teams to integrate CSIRT workflows with SIEM SOAR endpoint identity cloud and case management capabilities.

  • Use lessons learned from incidents tabletop exercises and control validation to strengthen repeatability and reduce operational friction.

  Governance Metrics & Capability Maturity

  • Establish operational metrics for CSIRT effectiveness including time-to-triage time-to-contain incident quality repeat findings and remediation follow-through.

  • Contribute to incident management standards procedures reporting audit response and regulatory readiness activities related to cyber incident response.

  • Translate CSIRT outcomes into risk-based insights that inform leadership decisions investment priorities and enterprise resilience improvements.

  People Strategy & Talent Development

  • Lead coach and develop a high-performing incident response team aligned to TDEOs intelligence-led operating model.

  • Set the CSIRT capability roadmap in alignment with Fusion priorities evolving adversary tradecraft regulatory expectations and enterprise risk outcomes.

  • Promote a continuous improvement culture that values technical depth operational discipline collaboration and calm execution under pressure.

  Required Qualifications

  • Prior people leadership experience in incident response security operations threat investigation digital forensics or a related cybersecurity function.

  • 8 years of experience in cybersecurity with deep experience leading or performing cyber incident response in complex enterprise environments.

  • Strong understanding of the incident response lifecycle including triage scoping containment eradication recovery root cause analysis and post-incident improvement.

  • Hands-on or leadership experience with SIEM SOAR EDR/XDR identity cloud security network telemetry case management and investigative tooling.

  • Working knowledge of digital forensics malware analysis threat hunting threat intelligence and adversary tactics techniques and procedures.

  • Experience partnering with legal privacy fraud insider threat technology operations and business stakeholders during sensitive or high-impact cyber events.

  • Ability to communicate complex technical issues clearly to senior leaders and translate response actions into risk-based business outcomes.

  Preferred Qualifications

  • Experience operating within a Fusion-style cross-domain security model integrating intelligence detection response and exposure management.

  • Experience leading response to ransomware credential compromise cloud/SaaS compromise third-party compromise data exposure or insider-related cyber investigations.

  • Experience developing response automation playbooks tabletop exercises purple-team learnings or incident-driven detection improvement processes.

  • Relevant certifications such as GCIH GCFA GCIA GNFA CISSP CISM or cloud security certifications are preferred.