Associate Director, IT Security | Incident Response

Wolters Kluwer; Chicago (IL); On-site; USD 160,000 - 286,000; Full time

Benefits offered by this job

Medical, Dental, & Vision Plans

401(k) Plan with matching

FSA/HSA

Commuter Benefits

Tuition Assistance Plan

Vacation and Sick Time

Paid Parental Leave

Job summary

Wolters Kluwer seeks an Associate Director, IT Security Incident Response to lead the enterprise cybersecurity incident response program. You will guide the full incident lifecycle from detection to recovery, working with global teams and executive leadership.

You will mentor a high‑performing security response team, develop playbooks and runbooks, and ensure alignment with NIST/ISO/PCI frameworks while driving continuous improvement across Blue Team capabilities.

Qualifications

• Bachelor's degree or equivalent professional experience.
• 10+ years in IT/cybersecurity or related fields.
• 5+ years in information security and incident response.
• Proven leadership of complex cybersecurity investigations.
• Experience in 24x7 security operations.
• Experience presenting to senior leadership.
• Familiarity with SIEM/SOAR and related tools.
• Knowledge of NIST/ISO/PCI frameworks.
• Experience with privacy and regulatory requirements.

Responsibilities

• Define and execute the incident response strategy and roadmap.
• Lead end-to-end incident response lifecycle across global operations.
• Oversee 24x7 incident response operations and escalation paths.
• Act as executive incident commander for major incidents.
• Mentor and develop the security response team.
• Develop and maintain incident response playbooks and runbooks.
• Lead post-incident reviews and root cause analyses.
• Support Blue Team tools and detection optimization.
• Collaborate with engineering and cloud teams to improve telemetry.
• Ensure comprehensive incident documentation and reporting.
• Communicate incidents and trends to stakeholders and leadership.
• Track security operations KPIs, SLAs, and SLOs.

Skills

Incident response leadership

24x7 security operations

Executive communication

Risk management

SIEM and SOAR proficiency

Digital forensics basics

Education

Bachelor's degree in Computer Science / MIS

Tools

Microsoft Sentinel

CrowdStrike

ThreatConnect

Recorded Future

Swimlane

Job description

We have an exciting opportunity for an Associate Director, IT Security Incident Response to join our Global Information Security team. This role will lead the enterprise cybersecurity incident response program, ensuring the consistent, timely, and effective management of suspected and confirmed cybersecurity incidents across Wolters Kluwer. You will provide leadership throughout the full incident lifecycle, including detection, triage, investigation, containment, eradication, recovery, and post‑incident improvement.

Responsibilities

• Define and execute the enterprise cybersecurity incident response strategy and roadmap, aligning capabilities with business objectives and risk posture.
• Lead the end‑to‑end incident response lifecycle, including monitoring, detection, triage, investigation, containment, eradication, recovery, post‑incident reviews, lessons learned, and problem management.
• Establish and oversee incident response operations, including 24x7 coverage, escalation pathways, and global coordination.
• Serve as the executive incident commander and primary escalation point for major cybersecurity incidents and crises.
• Build, mentor, and develop a high‑performing security response team, strengthening expertise in incident response, detection, and Blue Team practices.
• Develop and maintain incident response plans, playbooks, runbooks, simulations, and tabletop exercises to validate organizational readiness and response effectiveness.
• Lead post‑incident reviews, root cause analysis, lessons learned, and corrective actions, translating findings into measurable improvements.
• Support the operation and optimization of Blue Team technologies, including SIEM, SOAR, EDR/XDR, NDR, threat intelligence, and digital forensics platforms.
• Partner with security teams to improve monitoring and detection effectiveness through alert tuning, use‑case development, expanded detection coverage, and false‑positive reduction.
• Lead advanced investigations by synthesizing endpoint, network, cloud, identity, and threat intelligence data into risk‑based response actions.
• Partner with engineering, infrastructure, cloud, application, and attack surface management teams to improve telemetry, address control gaps, and implement enhancements identified through incidents and threat intelligence.
• Ensure comprehensive incident documentation and reporting, including playbooks, runbooks, dashboards, metrics, and incident records that support operational, audit, regulatory, and legal requirements.
• Deliver clear and actionable communications on incidents, risks, and trends to technical teams, business stakeholders, and executive leadership.
• Define and track security operations KPIs, SLAs, and SLOs to measure performance and drive continuous improvement.
• Integrate cyber threat intelligence into detection, response, proactive threat identification, and executive‑level threat briefings.
• Ensure incident response processes align with relevant regulatory, legal, and industry frameworks, including NIST and ISO standards.
• Partner with Risk, Legal, Privacy, and Compliance teams on incident handling, regulatory reporting, and enterprise risk management.
• Support the evaluation, integration, and optimization of security technologies, including the use of automation, AI, and advanced analytics to increase detection and response effectiveness.
• Partner with technology and product owners to maintain comprehensive security logging across applications, web services, WAF, cloud, network, infrastructure, and identity platforms, identifying and remediating telemetry gaps.
• Maintain response procedures for cloud, SaaS, identity‑provider, managed‑service, and critical‑supplier incidents, including notification, evidence‑access, cooperation, and recovery requirements.

Qualifications

• Bachelor’s degree in Computer Science, Management Information Systems, a related discipline, or equivalent professional experience.
• 10+ years of experience in Information Technology, cybersecurity, security operations, IT service management, or related areas.
• 5+ years of professional experience in information security, cybersecurity incident response, incident management, security risk management, or related functions.
• Demonstrated experience leading complex cybersecurity investigations and incident response activities.
• Experience operating in or supporting a 24x7x365 security operations environment.
• Experience engaging with senior and executive leadership during cybersecurity incidents, including communicating technical findings, business impact, risk, and recommended actions.
• Experience with threat intelligence, SIEM, SOAR, EDR/XDR, and related security technologies. Examples may include Microsoft Sentinel, CrowdStrike, ThreatConnect, Recorded Future, Swimlane, or comparable platforms.
• Experience with digital forensics and forensic investigation tools and techniques across cloud, endpoint, and other environments.
• Knowledge of security vulnerabilities, threat vectors, malicious code, network security, host/system security, identity, and access controls.
• Experience with risk analysis and risk management.
• Working knowledge of incident response and cybersecurity frameworks and standards, including NIST CSF, NIST 800‑53, ISO 27001, and PCI DSS.
• Experience supporting privacy, regulatory, and compliance requirements, including GDPR.
• Familiarity with ITIL service management methodology.
• Ability to develop, execute, and assess incident response exercises, including tabletop exercises and Red Team/Blue Team activities.
• Strong analytical, investigative, problem‑solving, and decision‑making skills.
• Excellent written and verbal communication skills with the ability to translate complex technical issues for both technical and non‑technical audiences.
• Demonstrated discretion and integrity when handling sensitive, confidential, and restricted information.
• Ability to prioritize and lead effectively during high‑pressure cybersecurity incidents.
• Flexibility to support a global organization and respond to significant incidents outside standard business hours when required.

Preferred Qualifications

• Professional certifications such as CISSP, GCIH, GCFA, GCFE, GCTI, ITIL, or other relevant cybersecurity certifications.
• Advanced programming or scripting knowledge.
• Experience assessing the security posture of external service providers and third parties.
• Experience with security automation, AI‑enabled security operations, and advanced analytics.
• Multilingual capabilities are a plus.

Travel Requirements

• Occasional domestic or international travel, up to 25%.

Compensation

Compensation: $160,100.00 - $286,000.00 USD. This role is eligible for bonus. Compensation range listed is based on primary location of the position. Actual base salary offer is influenced by a wide array of factors including but not limited to skills, experience and actual hiring location.

Benefits

• Medical, Dental, & Vision Plans
• 401(k)
• FSA/HSA
• Commuter Benefits
• Tuition Assistance Plan
• Vacation and Sick Time
• Paid Parental Leave

Culture & Inclusion

Wolters Kluwer reported 2025 annual revenues of €6.1 billion. The group serves customers in over 180 countries, maintains operations in over 40 countries, and employs more than 21,000 people worldwide. Our mission is to empower our professional customers with the AI‑powered solutions they need to make critical decisions, achieve successful outcomes, and increase productivity. We deliver trusted, AI‑powered expert solutions that combine deep domain knowledge, proprietary content, and advanced technology to provide expert‑validated insights, automate workflows, and drive better outcomes.

We’re innovators with impact. We provide expert software and information solutions that the world’s leading professionals rely on, in the moments that matter most. You’ll make a real difference in the lives of millions of people. Together with our customers, we help to advance sustainability, health, justice, prosperity, and commerce around the world. You can thrive at Wolters Kluwer, where diversity is core to our collective strength and high performance. Be your unique self, share your creative ideas, do your best work, and take time to grow in our caring and inclusive culture where you can belong.

We are committed to ensuring a welcoming environment and equitable opportunities for all employees regardless of background, nationality, race, ethnicity, gender, gender identity, age, sexual orientation, marital status, disability, or religion. This principle is ingrained in our company values and articulated in our Code of Business Ethics. At Wolters Kluwer, you’ll feel valued for your contributions, and you’ll know that your health, safety, and well‑being are important to us. Our global “Together we thrive” well‑being program reflects our commitment to supporting colleagues across physical, mental, social, and financial well‑being.

All qualified applicants will receive consideration without regard to race, color, religion, sex (including pregnancy, gender identity, transgender status, and sexual orientation), national origin, disability, age, genetic information, veteran status, or any other characteristic protected by applicable law, and we do not tolerate discrimination on any of these bases.

GDPR Wolters Kluwer (“we” or “us”) wants to inform you about the ways we process your personal information. In this Privacy & Cookie Notice we explain what personal information we collect, use and disclose.