Incident Response Program Lead

What You’ll Do 

The Incident Response Program Lead reports to the Information Security Manager and leads the development and operation of iSeatz's security incident response program while overseeing the day-to-day governance of our Managed Security Service Provider (MSSP).

In this hands-on leadership role, you will coordinate responses to security and compliance incidents, oversee vendor governance, strengthen security operations and incident readiness, and serve as a trusted advisor to the Information Security Manager and cross-functional partners.

Your Impact

• Own and continuously improve the Security Incident Response program, including policies, plans, playbooks, severity classifications, escalation criteria, communication protocols, and incident documentation
• Serve as the incident lead during security and compliance incidents, coordinating investigation, containment, eradication, recovery, evidence preservation, and post-incident activities across technical and business teams
• Oversee MSSP governance and performance, including onboarding, service integration, escalation procedures, service reviews, contractual requirements, SLAs, detection coverage, response times, quality standards, and agreed-upon metrics
• Partner with the MSSP and internal teams to improve alert quality, detection rules, investigation procedures, log coverage, threat intelligence, and response automation
• Hold MSSP accountable for contractual and operational performance, running service reviews and track deficiencies and corrective actions to closure.
• Lead incident response tabletop exercises and other required testing activities, documenting lessons learned, corrective actions, and program improvements and tracking remediation through completion
• Maintain incident response readiness through appropriate coverage, escalation capabilities, responder training, and coordination with the MSSP and designated internal responders
• Drive operational reporting on incident trends, response metrics, recurring issues, MSSP performance, control gaps, and areas requiring leadership attention
• Support the Information Security Manager with risk assessments, compliance activities, audit preparation, policy development, control reviews, vendor assessments, and remediation planning
• Advise leadership and technical teams on security events, emerging risks, operational priorities, and recommended actions, translating technical security issues into clear business risks and decisions
• Participate in an incident escalation or on-call rotation as required

What You Bring to the Table

• Five or more years of experience in information security, including substantial experience in incident response, security operations, detection and response, or a related discipline
• Demonstrated experience leading or coordinating security incidents across technical and business teams, with a strong understanding of the full incident response lifecycle
• Experience developing, maintaining, and testing incident response plans, procedures, and playbooks
• Experience working with an MSSP, MDR provider, SOC, or other managed security partner
• Working knowledge of security monitoring, SIEM, endpoint security, cloud security, vulnerability management, identity and access management, and network security, with experience using logs and technical evidence to investigate security events
• Experience with cloud-based environments, particularly AWS, and the security considerations associated with multi-account cloud architectures
• Knowledge of recognized security and incident response frameworks, such as NIST CSF, NIST SP 800-61, and the SANS incident response process
• Experience supporting security or compliance programs such as PCI DSS, SOC 2, ISO 27001, or similar frameworks
• Strong written and verbal communication skills, with the ability to produce clear incident documentation and communicate technical findings, risks, and recommendations to technical responders and business leaders
• Ability to work independently, establish priorities, and make sound decisions while driving initiatives through completion in high-pressure or time-sensitive situations
• Experience leading tabletop exercises involving executive leadership, Legal, Compliance, Engineering, and external service providers

Bonus Points

• Experience with detection engineering and security operations, including detection coverage and tuning, false-positive reduction, threat hunting, digital forensics, malware analysis, or security automation
• Hands-on experience with Sumo Logic, AWS Security tools, Cloudflare, Lacework, Sophos, or similar technologies
• Experience responding to incidents involving payment card data or other regulated or sensitive information
• Familiarity with PCI DSS 4.0.1 standards and payment-brand notification processes
• Experience developing or improving a security operations program within a growing or cloud-native organization
• Experience mentoring security professionals or leading project-based, matrixed, or virtual teams