Senior Manager Cybersecurity Incident Response

British American Tobacco; Xico; On-site; MXN 1,800,000 - 2,400,000; Full time

Benefits offered by this job

Annual bonus

Health benefits

Learning platforms

Career advancement

Job summary

British American Tobacco México busca un Senior Manager de Cybersecurity Incident Response en Monterrey. El rol combina liderazgo de equipos y experiencia técnica para dirigir incidentes críticos, actuar como Incident Commander y coordinar respuestas ante ransomware, robo de identidad y otras amenazas en un entorno 24x7 Follow-the-Sun.

Serás responsable de definir estrategias de investigación, colaborar con SOC, Cloud Security, Identity y Legal, y de impulsar la mejora continua de métricas IR,

Qualifications

• Titulación en Informática, Ciberseguridad o experiencia equivalente.
• 6–10 años de experiencia en ciberseguridad, especialmente IR/DF/Threat Hunting/SecOps.
• Experiencia liderando incidentes a escala empresarial como Incident Commander o líder técnico.
• Experiencia dirigiendo equipos técnicos y capacidad de gestión de personas.
• Capacidad de investigación principal en endpoints, nube, identidad y entornos empresariales.
• Experiencia en operaciones de seguridad globales Follow-the-Sun y comunicación con directivos.

Responsibilities

• Dirigir como Incident Commander para incidentes cibernéticos importantes (ransomware, ataques estatal, suplantación de identidad, etc.).
• Proporcionar actualizaciones basadas en riesgos a la alta dirección y coordinar con Legal, Compliance y otras áreas.
• Participar en rotaciones de servicio on‑call y asegurar operaciones Follow-the-Sun.
• Definir y liderar estrategias de investigación en endpoints, nube, identidad y redes.
• Analizar amenazas técnicas para establecer cronologías y contener daños.
• Impulsar mejoras continuas de métricas IR, automatización y playbooks.
• Colaborar con SOC, Cloud Security, Identity, Vulnerability y Security Engineering.
• Reclutar y desarrollar responders, manteniendo experiencia práctica en IR y forense.

Skills

Incident Commander

Team Leadership

Digital Forensics

Threat Hunting

Security Operations

Python/PowerShell

MITRE ATT&CK

Education

Bachelor's Degree in CS or Cybersecurity

Tools

Windows

Linux

Endpoint Forensics

Cloud (AWS/Azure)

Memory Analysis

SOAR

Job description

Senior Manager Cybersecurity Incident Response

Empresa : British American Tobacco Tipo de empleo : Tiempo completo Monterrey, Mexico

Descripción del trabajo - Senior Manager Cybersecurity Incident Response

BAT is evolving at pace into a global multi-category business. With products like VELO, VUSE and GLO we are on a mission to decrease the health impact of our industry

To achieve our ambition, we are looking for colleagues who are ready to Be The Change. Come, join us on this journey!

British American Tobacco Mexico has an exciting opportunity for a Senior Manager Cybersecurity Incident Response in Monterrey.

This role combinesprincipal-level technical expertise with people leadership and major incident command. The successful candidate will lead a team of investigators, act as Incident Commander during high-severity cyber incidents, remain technically engaged in complex investigations, and drive continuous improvement across BAT's detection, response and cyber resilience capabilities within a global 24x7 Follow-the-Sun operating model.

Your key responsibilities will include:

• Lead and act as Incident Commander for major cyber incidents, including ransomware, nation-state activity, identity compromise, BEC, insider threats, supply-chain attacks and data breaches, overseeing investigation, containment, recovery and executive communications.
• Provide risk-based updates to senior leadership and coordinate with Legal, Compliance, Privacy, Regulatory Affairs, Internal Audit and external stakeholders on incident response, regulatory obligations and breach notifications.
• Participate in the CDC management on-call rotation, ensuring effective Follow-the-Sun operations, governance, vendor management and coordination of external IR retainers, MDR/MSSP providers and specialist partners.
• Define and lead investigative strategies across endpoint, cloud, identity, SaaS, email and network environments, providing hands‑on leadership during complex investigations and ensuring high standards of evidence handling, technical quality and reporting.
• Conduct in-depth technical analysis of sophisticated cyber threats, establishing attack timelines, identifying root causes, assessing business impact and driving effective containment, eradication and recovery activities.
• Drive operational excellence through continuous improvement of Incident Response metrics, automation, AI adoption, playbooks, workflows, readiness exercises and post‑incident remediation tracking.
• Partner closely with SOC, Detection Engineering, SecOps, Cloud Security, Identity, Vulnerability Management and Offensive Security teams to strengthen enterprise cyber resilience and address systemic risks.
• Recruit, mentor and develop high‑performing incident responders while maintaining strong hands‑on expertise in enterprise incident response and incident command, endpoint forensics and memory analysis (Windows/Linux), cloud and identity investigations (AWS, Azure, Entra ID and Microsoft 365), threat hunting, network, email and malware analysis, adversary TTPs, Python/PowerShell scripting, SOAR, automation, enterprise detection engineering and the MITRE ATT&CK framework.

What are we looking for?

• Bachelor's Degree in Computer Science, Cybersecurity or equivalent practical experience.
• 6 to 10 years of cybersecurity experience, including significant experience in Incident Response, Digital Forensics, Threat Hunting or Security Operations.
• Proven experience leading large‑scale enterprise cyber incidents as Incident Commander or technical lead.
• Experience leading technical teams through people management or operational leadership.
• Demonstrated principal‑level investigative capability across endpoint, cloud, identity and enterprise environments.
• Experience working within global or Follow‑the‑Sun security operations and communicating with executive stakeholders.
• Experience within a multinational enterprise, cloud provider, technology company or leading incident response consultancy.(Desirable)
• GIAC certifications (GCFA, GCIH, GREM, GNFA, GCTI), CISSP or CISM. (Desirable)

What we offer you?

• We offer a market leading annual performance bonus (subject to eligibility)
• Our range of benefits varies by country and includes diverse health plans, initiatives for work‑life balance, transportation support, and a flexible holiday plan with additional incentives
• Your journey with us isn't limited by boundaries; it's propelled by your aspirations. Join us at BAT and become a part of an environment that thrives on internal advancement, where your career progression isn't just a statement – it's a reality we're eager to build together. Seize the opportunity and own your development; your next chapter starts here.
• You'll have access to online learning platforms and personalized growth programs to nurture your leadership skills
• We prioritise continuous improvement within a transformative environment, preparing for ongoing changes

WHY JOIN BAT?

We’re one of the few companies named as a Global Top Employer by the Top Employers Institute – certified in offering excellent employee conditions.

Collaboration, inclusion and partnership underpin everything we do here at BAT. We are looking forward to enabling every individual to thrive, regardless of gender, sexual orientation, marital or civil partnership status, gender reassignment, race, religion or belief, colour, nationality, ethnic or national origin, disability, age, skills, experience, education, socio‑economic and professional background, veteran status, perspectives and thinking styles. We know that embracing talent from all backgrounds is what makes us stronger and best prepared to meet our business goals.

We see the career breaks as opportunities not obstacles. Through The Global Returners program, we support professionals looking to restart their careers after an extended absence from the workforce (e.g. time out caring for family, parental leave, national service, sabbatical and/or starting an own venture).

Come bring your difference and see what is possible for you at BAT. Learn more about our culture and our award winning employee experience here.

If you require any reasonable adjustments or accommodations to help you perform at your best during the recruitment process, you are encouraged to notify us. We are fully committed to support you by making appropriate arrangements for you to demonstrate your full potential.