Incident Response Lead, 24/7 Security Operations

Amazon; Greater London; Remote; GBP 90,000 - 130,000; Full time

Job summary

Amazon UK Services Ltd. is seeking an Incident Response Manager to lead the end-to-end management of high-severity incidents (SEV1/SEV2) across global operations. You will own on-call rotations, coordinate IMTs, and drive post-incident reviews within tight SLAs.

Based in the UK or other EMEA locations, you will partner with GSOC, PXT, and Ops to ensure life safety, continuity, and brand protection, while continually improving response protocols and CTI matrix alignment.

Qualifications

• Bachelor's degree or equivalent in Risk Management, Business Administration, Security Management, or a related field.
• Experience applying KPIs to analyses, or building financial and operational reports/data sets that inform business decision-making
• Experience building cross-functional partnerships and influencing stakeholders across the organization to act without having a direct reporting relationship
• Knowledge of Microsoft Office products and applications at an advanced level
• Experience prioritizing and handling multiple assignments at any given time while maintaining commitment to deadlines, or experience with end-to-end project management
• Experience in written and verbal communication with the ability to present complex technical information in a clear and concise manner to executives and non-technical leaders
• Experience in a high-volume environment, such as a security operations center, event security, call center, or crisis management/emergency response center

Responsibilities

• Lead end-to-end coordination of high severity incidents (SEV1/SEV2), managing the full lifecycle from initial notification through mitigation, stabilization, and closure
• Own 24/7/365 on-call rotation, responding to threats and incidents within the CTI Matrix per SOG escalation procedures, including Slack channel activation and senior leadership notification
• Coordinate Immediate Mitigation calls with site-level Incident Commanders and IMTs, assigning action items to ensure life safety, operational continuity, and brand protection
• Execute tactical response protocols including video lockdown, ESU/Off-Duty deployments, and OSINT/SOCMINT analysis within established timelines
• Prepare site risk overviews and deliver incident summaries to WWOS senior leadership within 4 hours of incident onset
• Manage Incident Room operations including real-time updates, dynamic action tracking, EMT notifications, and stakeholder conference calls
• Lead After Action Reviews within 3 days of incident conclusion, driving corrective actions and mechanism implementation to prevent recurrence
• Maintain and validate high severity protocols, the CTI Matrix, escalation workflows, and response timelines through continuous improvement
• Partner with GSOC, Regional S&LP, Operations, WHS, and PXT to influence decision-making and ensure site-level IMT readiness per WWOS Critical Incident Response standards

Skills

Written and verbal communication

Project management

Cross-functional partnerships

Security operations center experience

MS Office

Education

Bachelor's degree or equivalent in Risk Management, Business Administration, Security Management, or related field

Tools

ArcGIS

Palantir

BSI

Audit Board

Job description

Amazon UK Services Ltd. is seeking an Incident Response Manager to lead the end-to-end management of high-severity incidents (SEV1/SEV2) across global operations. You will own on-call rotations, coordinate IMTs, and drive post-incident reviews within tight SLAs.

Based in the UK or other EMEA locations, you will partner with GSOC, PXT, and Ops to ensure life safety, continuity, and brand protection, while continually improving response protocols and CTI matrix alignment.