Cloud Cyber IR Lead — Global Incident Response Manager

WTW; United States; On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Health benefits

Paid time off

Retirement plan

Job summary

WTW is seeking a Cyber Security Cloud Incident Response IR Manager to lead the incident response program across cloud environments. You will coordinate with SOC, Threat Hunting, CTI, and other teams to contain, eradicate, and recover from incidents, while communicating with executives, Legal, HR, and Compliance.

You will mentor analysts, develop playbooks, and refine processes. The role partners with MSSPs to strengthen security posture against evolving threats in a hybrid environment.

Qualifications

• Minimum 7 years of incident response experience with strong cybersecurity fundamentals.
• Proficient in forensic analysis, malware analysis, and network traffic analysis.
• Experience with SIEM tools, EDR platforms, and threat intelligence integration.
• Ability to lead high-stakes incidents and coordinate cross-functional teams.
• Deep knowledge of MITRE ATT&CK, cyber kill chain, and IR methodologies.
• Excellent verbal and written communication, including executives.
• Experience with Sentinel, Splunk, Carbon Black is preferred.
• Mentoring and tabletop exercises to improve team readiness.

Responsibilities

• Lead significant security incidents as primary IR lead, coordinating across teams.
• Drive cross-cloud IR workflows and forensic investigations across hybrid environments.
• Lead global response teams and integrate SIEM/SOAR platforms with MSSPs.
• Establish, refine incident response processes, playbooks, and workflows.
• Serve as central contact for incident activities with Legal, HR, Compliance, and leadership.
• Lead root cause analysis and post-incident reviews to strengthen defenses.
• Collaborate with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability Management.
• Develop automation scripts and workflows to boost detection and response.
• Contribute to KPIs and metrics to measure IR effectiveness.
• Maintain incident handling records and ensure policy/audit alignment.

Skills

Incident response leadership

Cybersecurity principles

Communication skills

Mentoring

Regulatory compliance

Education

CISSP

GCIH

GCFA

CISM

Tools

Sentinel

Splunk

Carbon Black

Job description

WTW is seeking a Cyber Security Cloud Incident Response IR Manager to lead the incident response program across cloud environments. You will coordinate with SOC, Threat Hunting, CTI, and other teams to contain, eradicate, and recover from incidents, while communicating with executives, Legal, HR, and Compliance.

You will mentor analysts, develop playbooks, and refine processes. The role partners with MSSPs to strengthen security posture against evolving threats in a hybrid environment.