Manager, Security Operations – Incident Response

. Serve as incident commander for security incidents, directing containment, evidence preservation, scope determination, eradication and recovery .

Posted 10/15/2026full-timeNew York City • New York • United StatesSeniorLead💰 $240,000 - $300,000 per yearWebsite

Tools & technologies

Cyber Security

Key responsibilities & impact

Serve as incident commander for security incidents, directing containment, evidence preservation, scope determination, eradication and recovery
Operate the Firm’s incident response framework, including event triage, severity determination and escalation
Produce incident documentation and coordinate with internal and external stakeholders, including matters conducted under legal privilege
Support the CISO on notification analysis, cyber insurance and law enforcement engagement
Lead post-incident reviews and drive root cause remediation
Design and conduct tabletop exercises involving Firm leadership and counsel
Own the detection program across SIEM, endpoint, identity, email and browser telemetry
Measure detection coverage against MITRE ATT&CK techniques and manage alert quality and false positive rates
Manage the operational relationship with the managed detection and response provider
Own exposure management across vulnerabilities, misconfigurations, attack paths and internet-facing exposure
Translate threat intelligence into detections, hunts and briefings
Monitor and manage takedown of brand impersonation and lookalike domains
Lead, develop and grow a team of security analysts and engineers
Provide operational input to security engineering, governance and compliance

What you’ll need

Demonstrated incident command during live security incidents, including direct coordination with legal counsel
Hands-on depth with SIEM, endpoint detection and response, and detection engineering
Experience governing a managed security service provider
Practical command of MITRE ATT&CK
Familiarity with NIST SP 800-61, the NIST Cybersecurity Framework, and ISO27001
Experience driving vulnerability and exposure remediation through teams outside the direct reporting line
Written communication suitable for review by counsel and Firm leadership
Strong interpersonal skills and ability to influence at all levels
Strong work ethic, discretion and judgment handling privileged and market-sensitive information
Experience in a law firm, professional services firm or financial institution preferred
A Degree in Information Technology, Engineering or a related field
Minimum of 8 years’ experience in information security, including at least 3 years leading incident response or security operations
GCIH, GCFA, GCIA, CISSP or CISM preferred

Comp & perks