Lead the Cyber Incident Response Program
- Oversee the full incident response lifecycle: preparation, identification, containment, eradication, recovery, and post-incident lessons learned (per NIST SP 800-61 or similar frameworks).
- Manage day-to-day incident response operations, including triage, investigation coordination, forensic analysis, and executive-level reporting.
- Develop, maintain, and regularly test incident response playbooks, runbooks, and escalation procedures.
Enhance Detection Capabilities
- Drive continuous improvement of threat detection engineering, including tuning of SIEM rules, EDR/XDR configurations, threat intelligence integration, and behavioral analytics.
- Collaborate with SOC, threat hunting, and security engineering teams to reduce false positives, accelerate mean time to detect (MTTD) and respond (MTTR), and implement proactive detection use cases.
- Lead initiatives to mature internal blue-team capabilities across endpoints, cloud, identity, network, and email environments.
Manage MSSP Services Transition
- Lead the end-to-end transition of MSSP services from the current provider to the new partner, including planning, knowledge transfer, contract/SLA alignment, and cutover execution.
- Conduct due diligence on the new MSSP, define transition success criteria, and mitigate risks during handover (e.g., service continuity, data migration, access controls).
- Establish governance for the new MSSP relationship, including performance monitoring, regular service reviews, incident handoff protocols, and continuous improvement feedback loops.
- Ensure the transition strengthens rather than disrupts detection and response effectiveness.
Team Leadership & Development
- Build, mentor, and lead a high-performing incident response team (internal analysts, responders, and cross-functional partners).
- Provide performance management, career development, and technical coaching to team members.
- Foster a culture of continuous learning, tabletop exercises, red/blue team simulations, and post-incident reviews.
- Stakeholder Collaboration & Reporting
- Serve as the primary point of contact for major incidents, briefing executive leadership, legal, compliance, and external regulators as needed.
- Coordinate with IT, legal, risk, business units, and external partners (e.g., law enforcement, forensics firms) during incidents.
- Produce executive-level reports on incident trends, program maturity, detection improvements, and transition status.
Program Maturity & Compliance
- Align incident response practices with industry standards (NIST, ISO 27001, MITRE ATT&CK, etc.) and regulatory requirements.
- Drive metrics-driven improvements and maturity assessments for the IR program.
- Contribute to enterprise-wide security initiatives, including vulnerability management, threat intelligence, and security awareness.