Manager, Cyber Incident Response

NBCUniversal

. Manage Incident Response operations, including prioritization, resource allocation, shift coverage, tooling requirements, workflow management, and escalation processes .

Posted 10/21/2026full-timeRemote • Florida • United StatesSeniorLead💰 $110,000 - $170,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in managing Incident Response operations, including incident handling, coordination across teams, and adherence to cybersecurity protocols. Proficient in developing incident management processes and utilizing forensic tools within cloud environments.

Highest-signal resume keywords

Incident Response ManagementCybersecurity Operations LeadershipForensic Tools and AnalysisCloud Security ExpertiseSecurity Certifications (GCIH, CISSP)

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseCybersecurityThreat DetectionNetwork ArchitectureIncident Management ProcessesForensic AnalysisCloud Security (AWS, Azure, Google Cloud)MITRE ATT&CK FrameworkEDR/XDR/SOAR TechnologiesCase Management

Soft Skills

LeadershipCoachingOrganizational SkillsProblem-SolvingCommunication Skills

Tools & Technologies

Endpoint Detection and ResponseNetwork Analysis ToolsEmail Security TechnologiesCloud Security TechnologiesIncident Response Playbooks

Certifications & Qualifications

GCIHGCFAGNFAGCIACISSP

Industry Keywords

Cyber Incident ResponseSecurity Operations CenterCyber Kill ChainNIST Incident Response GuidanceAdversary Techniques

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud Platform

About the role

Key responsibilities & impact

Manage Incident Response operations, including prioritization, resource allocation, shift coverage, tooling requirements, workflow management, and escalation processes
Ensure the NBCUniversal Incident Response Plan and procedures are implemented and followed
Oversee cyber incidents across the enterprise from escalation and validation through containment, remediation, recovery support, and closure
Serve as Incident Handler or Incident Commander for significant incidents
Coordinate response activities with impacted businesses, technical owners, and partner teams
Act as managerial escalation point for potential cyber incidents, responder support needs, and leadership decisions
Participate in the manager on-call rotation for cyber incident escalation and handling in a 24x7x365 global environment
Supervise operational performance across shifts and ensure prioritization, ticket ownership, escalation discipline, and standards adherence
Review shift handovers, queue health, and open incidents for continuity and accountability
Maintain event and incident documentation standards, case-management requirements, KPIs, and process adherence
Monitor operational metrics and trends, identify gaps, and implement improvements
Lead governance of response processes, playbooks, tuning requests, automation opportunities, and technical procedures
Drive the maturity, enhancement, and strategy of the Incident Response program
Partner strategically with Information Security Officers, business stakeholders, and security and technology teams
Develop and maintain process documentation, ownership, review cycles, approvals, and change management
Lead, coach, and develop Incident Response personnel
Create and deliver monthly metrics and executive reporting
Communicate incident status, operational concerns, decisions, and risk to business VIPs and senior leadership

Requirements

What you’ll need

Bachelor’s degree in an information technology-related field and/or equivalent work experience
Seven or more years of cybersecurity or investigations experience
At least four years in Incident Response, a Security Operations Center, threat intelligence, or a similar function
Previous experience leading incident response operations, cybersecurity personnel, or complex incident coordination
In-depth understanding of cyber threats, adversary techniques, response procedures, network and enterprise architecture, and threat detection
Ability to make evidence-based decisions under uncertainty and coordinate response activities across multiple teams
Willingness to work in a fast-paced, high-demand role that may require nonstandard working hours
Availability to support employee development and accept escalations in a 24x7x365 global environment
Strong organizational skills and ability to manage multiple workstreams, incidents, and escalation paths
Working knowledge of web application architecture, networking, identity, endpoint, email, and cloud services
Experience with host-based and network-based forensic tools and analysis
Knowledge of MITRE ATT&CK, the Cyber Kill Chain, the Diamond Model, and NIST incident response guidance
Experience applying security concepts in AWS, Azure, and/or Google Cloud Platform environments
Knowledge of EDR, XDR, SOAR, case management, and response automation
Experience developing or improving incident-management processes, playbooks, metrics, or automation
Exceptional written and verbal communication skills, including briefing technical professionals, business stakeholders, and senior executives
Strong leadership, coaching, interpersonal, and problem-solving skills
Relevant security certifications such as GCIH, GCFA, GNFA, GCIA, CISSP, or equivalent are desired
Prior experience managing a Cyber Incident Response, Security Operations Center, or related cyber defense function is desired
Experience supporting incident response or SOC operations for a large, complex, or global enterprise is desired
Hands-on familiarity with endpoint detection and response, forensic, network-analysis, email-security, and cloud-security technologies is desired

Benefits

Comp & perks

Medical, dental and vision insurance
401(k)
Paid leave
Tuition reimbursement
Employee discounts and other perks
Bonus eligibility