Security Incident Manager

Responsibilities

• Serve as the primary coordinator for major cybersecurity, trust & safety, and fraud incidents: organizing tasks, tracking progress, and maintaining clear communication across all involved teams and stakeholders in ServiceNow Security Incident Response (SIR).
• Coordinate the full incident lifecycle: containment, eradication, recovery, and closure, ensuring containment is validated against client control-testing standard before an incident is marked resolved.
• Develop, maintain, and enforce incident response playbooks and protocols in partnership with SOC capability champs across Insider Risk, Escalations, and DFIR, ensuring consistency without duplicating existing ownership.
• Produce regular incident reporting, from operational status updates to board/SLT-level summaries, with clear actions taken, outcomes, and recommendations for improvement.
• Run the lessons-learned loop: facilitate post-incident hot washes, convert findings into documented action items, and drive report/playbook updates on a regular cadence rather than ad hoc.
• Provide clear, comprehensive documentation and updates to relevant internal partners, including IT, Legal, Compliance, and Customer Support.
• Support onboarding and training for team members on incident response protocols and tooling, reinforcing adherence to established SOC processes.
• Stay current on incident response and fraud/trust & safety best practices, adapting SOC processes as threats and requirements evolve.

Skills

• Demonstrated ability to manage multiple concurrent incidents, tasks, and stakeholders in a high-pressure environment while maintaining accuracy and composure.
• Solid working knowledge of incident response procedures across cybersecurity, trust & safety, and fraud contexts.
• Excellent organizational, written, and verbal communication skills; able to translate technical detail for non-technical audiences and vice versa.
• Experience with ServiceNow Security Incident Response (SIR) or a comparable ITSM/SIR platform strongly preferred.
• Comfort working across Insider Risk, Escalations, and DFIR functions without owning their technical domains directly.

Qualifications

Education Required: Bachelor’s degree in an IT-related or Engineering field.

Education Preferred: Bachelor’s degree in an IT-related or Engineering field.

Benefits

• Comprehensive healthcare coverage (medical, dental, and vision plans)
• Supplemental coverage (accident insurance, critical illness insurance and hospital indemnity)
• 401(k)-retirement savings
• Life & disability insurance
• Employee assistance program
• Identity theft protection
• Legal support
• Auto and home insurance
• Pet insurance
• Employee discounts with some preferred vendors

Pay

Pay rate: $42.00 - $45.00 per hour DOE

Duration

Duration: 12+ months (possibility of extension)

Location

Work is expected to be done on 100% Remote.