Incident Response Program Lead

iSeatz

. Own and continuously improve the Security Incident Response program, including policies, plans, playbooks, severity classifications, escalation criteria, communication protocols, and incident documentation .

Posted 10/22/2026full-timeRemote • United StatesSenior💰 $146,000 - $155,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in leading security incident response initiatives, including the development and testing of incident response plans and procedures. Proficient in managing relationships with Managed Security Service Providers (MSSPs) and ensuring compliance with security frameworks such as PCI DSS and ISO 27001.

Highest-signal resume keywords

Incident Response Lifecycle ManagementMSSP Governance and Performance OversightSecurity Monitoring and SIEM ExpertiseCloud Security and AWS ProficiencyCompliance Frameworks Knowledge

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseSecurity OperationsDetection and ResponseIncident Response PlansSecurity MonitoringCloud SecurityVulnerability ManagementIdentity and Access ManagementNetwork SecurityTechnical Evidence Investigation

Soft Skills

Strong Written CommunicationStrong Verbal CommunicationDecision-Making Under PressureIndependent WorkPrioritization Skills

Tools & Technologies

SIEMAWSMSSPMDR ProviderSOC

Industry Keywords

NIST CSFNIST SP 800-61SANS Incident Response ProcessPCI DSSSOC 2ISO 27001

Tech Stack

Tools & technologies

AWSCloud

About the role

Key responsibilities & impact

Own and continuously improve the Security Incident Response program, including policies, plans, playbooks, severity classifications, escalation criteria, communication protocols, and incident documentation
Lead security and compliance incident responses across technical and business teams, including investigation, containment, eradication, recovery, evidence preservation, and post-incident activities
Oversee Managed Security Service Provider governance and performance, including onboarding, service integration, escalations, service reviews, contractual requirements, SLAs, detection coverage, response times, quality standards, and metrics
Partner with the MSSP and internal teams to improve alert quality, detection rules, investigation procedures, log coverage, threat intelligence, and response automation
Hold the MSSP accountable for contractual and operational performance; track deficiencies and corrective actions to closure
Lead incident response tabletop exercises and required testing; document lessons learned and track remediation
Maintain incident response readiness through coverage, escalation capabilities, responder training, and coordination with internal responders and the MSSP
Report on incident trends, response metrics, recurring issues, MSSP performance, control gaps, and leadership concerns
Support the Information Security Manager with risk assessments, compliance activities, audit preparation, policy development, control reviews, vendor assessments, and remediation planning
Advise leadership and technical teams on security events, emerging risks, operational priorities, and recommended actions
Participate in an incident escalation or on-call rotation as required

Requirements

What you’ll need

Five or more years of experience in information security, including substantial experience in incident response, security operations, detection and response, or a related discipline
Demonstrated experience leading or coordinating security incidents across technical and business teams
Strong understanding of the full incident response lifecycle
Experience developing, maintaining, and testing incident response plans, procedures, and playbooks
Experience working with an MSSP, MDR provider, SOC, or other managed security partner
Working knowledge of security monitoring, SIEM, endpoint security, cloud security, vulnerability management, identity and access management, and network security
Experience using logs and technical evidence to investigate security events
Experience with cloud-based environments, particularly AWS, and multi-account cloud architectures
Knowledge of NIST CSF, NIST SP 800-61, and the SANS incident response process
Experience supporting PCI DSS, SOC 2, ISO 27001, or similar security/compliance frameworks
Strong written and verbal communication skills
Ability to work independently, establish priorities, and make sound decisions in high-pressure or time-sensitive situations
Experience leading tabletop exercises involving executive leadership, Legal, Compliance, Engineering, and external service providers

Benefits

Comp & perks

Robust health insurance
401(k) plan with company matching
Generous paid time off
Up to eight weeks of paid parental leave for eligible caregivers
Remote-first work with flexibility and autonomy
Annual professional development allowance
Tools, autonomy, and support to succeed
Reasonable accommodation for job application, interview, essential job functions, and employment benefits and privileges