Cyber Security Incident Response Assistant Manager

The Role

The Cyber Security Incident ResponseAssociate Managerwill play a key role in managing and responding to security incidents within WTWs Global Cyber Security Incident Response Team. Responsibilities of this role will include:

• Serve as the primary lead for significant security incidents coordinating response efforts across technical and business teams to minimize impact and ensure timely resolution.

• Establish refine and maintain incident response processes playbooks and workflows to align with industry best practices and WTWs organizational needs.

• Act as the central point of contact for incident response activities ensuring effective communication with internal and external stakeholders including senior leadership Legal HR and Compliance teams.

• Leverage AI and automation to accelerate incident containment response and remediation embedding AI-assisted triage alert enrichment and decision support into SOAR playbooks and response workflows

• Lead the in-depth technical investigation of security incidents escalated from the SOC ensuring timely containment eradication and recovery while identifying root causes and potential impact.

• Adept at leading global response teams integrating SIEM/SOAR platforms and collaborating with MSSPs to mitigate cloud-native and supply chain attack.

• Work closely with SOC Threat Hunting CTI Insider Threat and Vulnerability Management teams to ensure seamless coordination and information sharing during incidents.

• Lead root cause analysis and post-incident reviews to identify gaps implement lessons learned and enhance the overall incident response program.

• Evaluate and prioritize incidents based on potential impact and severity escalating issues to higher levels of management or other teams as required.
• Contribute to the development and maintenance of key performance indicators (KPIs) and metrics to measure the effectiveness of incident response processes.
• Act as a liaison between technical teams and business stakeholders ensuring clear communication during incidents and status updates.

The Requirements

• Minimum 5 years of experience in SOC or incident response with a strong understanding of cybersecurity principles frameworks and tools.

• Understanding of AI/ML applications in security operations including AI-augmented detection triage and response automation.

• Awareness of AI-specific threats and incident types (prompt injection model/data poisoning sensitive-data exposure via GenAI) and familiarity with OWASP LLM Top 10 / MITRE ATLAS.

• Hands-on cloud incident response across Azure AWS and/or GCP including cloud-native log sources (Azure Activity/Entra ID sign-in logs AWS CloudTrail) and the reality that cloud IR differs from on-prem.

• Proven ability to lead high-stakes security incidents and coordinate cross-functional teams effectively.

• Deep understanding of MITRE ATT&CK cyber kill chain and incident response methodologies.

• Exceptional verbal and written communication skills with the ability to convey complex technical concepts to non-technical audiences including executives.

• A proactive and decisive mindset with the ability to operate under pressure.

• Strong analytical and problem-solving skills to make informed decisions in complex situations.

• Collaborative and adaptable with a passion for mentoring and developing team members.

Note: Employment-based non-immigrant visa sponsorship and/or assistance is not offered for this specific job opportunity.

Compensation and Benefits

Base salary range and benefits information for this position are being included in accordance with requirements of various state/local pay transparency legislation. Please note that salaries may vary for different individuals in the same role based on several factors including but not limited to location of the role individual competencies education/professional certifications qualifications/experience performance in the role and potential for revenue generation (Producer roles only).

Compensation

The base salary compensation range being offered for this role is $120000.00-$160000.00 USD annually. This role is also eligible for an annual short-term incentive bonus.

Company Benefits

WTW provides a competitive benefit package which includes the following (eligibility requirements apply):

• Health and Welfare: Mental health/emotional wellbeing (including Employee Assistance Program) medical (including prescription drug coverage and fertility benefits) dental vision Health Savings Account Commuter Accounts Health Care and Dependent Care Flexible Spending Accounts company-paid life insurance supplemental life insurance AD&D group accident group critical illness group legal identity theft protection wellbeing program adoption assistance surrogacy assistance auto/home insurance pet insurance and other work/life resources.
• Leave Benefits: Paid Holidays Annual Paid Time Off (includes state/local paid leave where required) Short-Term Disability Long-Term Disability Other Leaves (e.g. Bereavement FMLA ADA Jury Duty Military Leave and Parental and Adoption Leave)Paid Time Off (only included for Washington roles)
• Retirement Benefits: Qualified contributory pension plan (if eligible) and 401(k) plan with annual nonelective company contribution. Non-qualified retirement plans available to senior level colleagues who satisfy the plans eligibility requirements.

Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles County Fair Chance Ordinance for Employers we will consider for employment qualified applicants with arrest and conviction records.

This position will remain posted for a minimum of three business days from the date posted or until sufficient/appropriate candidate slate has been identified.

EOE including disability/vets