Senior Manager, CSIRT Cybersecurity Defense

What you'll do

• Manage a shift of CSIRT analysts responsible for alert intake, triage, and response.
• Direct all phases of the incident response lifecycle including analysis, containment, eradication, and recovery.
• Develop and maintain incident response policies, procedures, playbooks, and escalation workflows.
• Serve as the primary point of contact to coordinate cross-functional teams during major security incidents.
• Report incident metrics, threat trends, and risk insights to senior leadership for strategic decision-making.
• Provide coaching, technical guidance, and mentorship to build a high-performing team of responders.
• Conduct tabletop exercises and technical simulations to validate and strengthen response capabilities.
• Identify opportunities to automate and streamline response processes using SOAR platforms.

What we're looking for

• A 4-year degree or equivalent experience in a related field is required.
• At least 5 years of SOC/IR experience is required.
• 1 to 3 years of experience building and leading high-performing cybersecurity teams with direct reports is required.
• A cybersecurity certification such as GIAC, Offensive Security, or ISC2 is required.
• Deep understanding of monitoring, detection, incident response, artifact collection, cloud environments, and attacker mindset is required.
• Ability to lead CSIRT effectively during high-severity security incidents and communicate technical information clearly is required.
• Experience with digital forensics, reverse engineering, threat intelligence, threat hunting, or SOAR (preferred).
• Experience with various operating systems, host/network security controls, and working in a Cyber Fusion Center (preferred).