Manager, Security Incident Response
Leads and develops a security incident response team while driving automation, AI-assisted workflows, operational maturity, and response strategy. The role requires 5+ years of incident response experience, people leadership, technical depth, and calm management of high-severity incidents.
About the job
Responsibilities
- Build, lead, and develop a team of security incident responders and security builders.
- Set expectations, establish ownership, delegate work, and support team growth and performance.
- Define and drive the security incident response roadmap and strategic priorities, including agentic incident response, threat hunting, and insider risk investigations.
- Scale team capacity through AI-assisted tooling and automation with appropriate human-judgment, approval, auditability, and rollback controls.
- Oversee detection, triage, containment, remediation, and post-incident learning.
- Serve as an escalation point and incident manager for complex or high-severity events, including participation in the on-call rotation.
- Partner with Detection Engineering, Cyber Threat Intelligence, Red Team, and other teams to close detection and response gaps.
- Evolve playbooks, training, tabletop exercises, metrics, and reporting.
- Track and report incident trends, operational metrics, program maturity, and the impact of automation and AI tooling.
Requirements
- 5+ years of security incident response experience.
- 2+ years as a people manager or technical leader supporting career development and performance management.
- Experience building or scaling incident response automation, tooling, or AI-assisted workflows for triage, enrichment, or investigation.
- Experience defining ownership, delegating work, and measuring outcomes.
- Experience managing high-pressure security incidents with clarity and calm.
- Strong understanding of cloud-native, SaaS, and identity-driven attack techniques and response methods.
- Strong written and verbal communication skills for technical and non-technical audiences.
- Experience breaking strategic initiatives into projects, coordinating team sprints, and managing competing priorities.
- Ability to foster psychological safety and stability in stressful environments.
Compensation
- United States: $192,000–$278,000 USD annual base salary, plus benefits, paid time off, equity, and applicable incentive programs.
- Canada: $171,000–$248,000 CAD annual base salary, plus benefits, paid time off, equity, and applicable incentive programs.
Skills
Incident Response, Security Automation, Ai-Assisted Workflows, Threat Hunting, Insider Risk, Cloud Security, Saas Security, Identity Security, Incident Management, Detection Engineering, Cyber Threat Intelligence, Red Teaming, Tabletop Exercises, On-Call Operations
Similar jobs
Security Engineering jobs
Decagon
San Francisco, CA
Own and operate Decagon’s privacy and GRC programs, including regulatory compliance, data governance, customer security engagements, audits, and cross-functional privacy initiatives. The role requires 5+ years of GRC experience, strong communication and project management skills, and familiarity with enterprise security controls.
Anthropic
San Francisco, CAThe analyst develops and evaluates cyber product policies, enforcement guidance, controlled-access frameworks, and launch-review inputs for AI systems. The role requires strong policy writing, cybersecurity or platform-enforcement familiarity, technical security literacy, and cross-functional communication.
Decagon
San Francisco, CA
Manages Decagon’s governance, risk, and compliance program, including enterprise certifications, audit evidence, vendor risk, customer security assessments, and RFP responses. Requires 3–5 years of GRC experience, strong communication and project management skills, and familiarity with technical security controls and privacy regulations.
Vercel
San Francisco, CABuild and operate trust and safety systems that detect and mitigate abuse at internet scale. The role combines security engineering, large-scale data analysis, and applied LLM techniques, requiring 5+ years of relevant experience and strong Python and JavaScript/TypeScript skills.
OpenAI
San Francisco, CAThe Red Team Specialist evaluates AI models for cyber capabilities, safeguard failures, and agentic-system abuse risks. The role combines hands-on security testing, automated evaluation infrastructure, risk assessment, and cross-functional communication.