D&T Manager - Cyber Security, Incident Response

KEY ACCOUNTABILITIES

Core Responsibilities

• Lead a 24x7 Cyber Security Incident Response Team responsible for alert triage, incident validation, investigation, containment, escalation, and coordination of cybersecurity threats.
• Build and lead a high-performing team of incident responders who are strong investigators, sound decision makers, and empowered operators with the authority to contain threats in accordance with approved procedures.
• Own day-to-day cyber incident response operations and ensure incidents are handled with speed, consistency, quality, and accurate tracking in approved systems.
• Develop, implement, maintain, test, and annually review the Cybersecurity Incident Response Plan, playbooks, and response procedures to ensure alignment with Enterprise standards and industry best practices.
• Coordinate cyber incident handling wit h disaster recovery, business contingency planning, senior management, and key technology stakeholders, including appropriate escalation and controlled communications.
• Establish and monitor key operational metrics, including response time, containment time, case quality, and playbook adherence, and periodically test team capabilities against service levels.
• Lead post-incident reviews, root cause analysis, and lessons learned, and drive continuous improvement across detections, playbooks, automations, and response processes in partnership with detection engineering, threat hunting, and platform teams.
• Identify skill gaps across IR functions (DFIR, threat hunting, malware analysis, cloud IR, OT security, AI security, automation, etc.)
• Ensure structured upskilling pathways with certifications, labs, simulations, and hands-on exercises
• Build succession plans for critical roles
• Rotate team members across different incident types and specializations to avoid stagnation

People Responsibilities

• Lead hiring, onboarding, workforce planning, and shift/coverage management for a 24x7 incident response team.
• Build team capability through coaching, training, scenario-based exercises, and stretch opportunities that develop responders into stronger investigators and decision makers.
• Set clear performance expectations, measure results through defined KPIs, and hold team members accountable for quality, speed, and sound judgment.
• Conduct regular 1:1s, provide timely coaching and feedback, and create meaningful development plans for each team member.
• Foster a culture of calm execution, accountability, collaboration, and continuous learning during high-pressure incident response.
• Ensure team members understand and follow cybersecurity policies, standards, and response procedures.
• Build and strengthen Team Capability Building
• Create individualized development plans for each analyst based on strengths, aspirations, and business needs
• Conduct quarterly career conversations, not just performance reviews
• Help team members understand possible cyber career paths
• Coach analysts on executive communication and stakeholder management, not only technical depth
• Operational Excellence Through People
• Encourage automation mindset to reduce repetitive analyst fatigue
• Ensure knowledge is documented and not concentrated people

Partnerships and Benchmarking

• Partner with internal technology, infrastructure, identity, endpoint, cloud, legal, privacy, and communications teams to improve preparedness and response effectiveness.
• Maintain strong relationships with peer security leaders, industry partners, and key vendors to benchmark capabilities and stay current on leading practices.
• Leverage external intelligence, peer benchmarking, incident trends, and industry developments to improve team processes, playbooks, and tooling.
• Serve as a key liaison to higher-tier detection and threat hunting teams to ensure effective escalation paths, feedback loops, and operational alignment.

MINIMUM QUALIFICATIONS

Minimum Degree Requirements:

Bachelors

Preferred Degree Requirements:

Masters

PREFERRED QUALIFICATIONS