Cloud Incident Response Lead, Global Cyber Defense

WTW; Atlanta (GA); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Health and welfare benefits

401(k) plan

Paid time off

Life insurance

Disability benefits

Job summary

WTW is seeking an experienced Cyber Security Incident Response IR Manager to lead complex security incidents within the ICSD function. You will establish incident response procedures, coordinate with SOC, Threat Hunting, CTI, and Insider Threat teams, and liaise with HR, Legal, and Compliance to ensure effective incident management.

The role requires 7+ years in incident response, strong forensic and SIEM/EDR skills, and the ability to communicate effectively with executives.

Qualifications

• Minimum 7 years of incident response experience and strong cybersecurity foundation.
• Proven ability to lead high-stakes security incidents with cross-functional teams.
• Deep understanding of MITRE ATT&CK, cyber kill chain and IR methodologies.
• Excellent verbal and written communication for executives and non-technical audiences.
• Industry certifications such as CISSP, GCIH, GCFA, or CISM preferred.
• Experience with SIEM/EDR platforms and threat intel integration required.
• Exposure to multiple platforms and vendor ecosystems.

Responsibilities

• Lead significant security incidents as primary point of contact and coordinate cross-functional response.
• Drive rapid containment, remediation, and post-incident root cause analysis.
• Collaborate with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability teams.
• Develop and refine IR playbooks, playbooks, and automation to improve detection and response.
• Mentor junior analysts and conduct tabletop exercises to boost team readiness.
• Communicate incident status to senior leadership and regulatory stakeholders.

Skills

Incident response leadership

Forensic analysis

SIEM/EDR expertise

Cloud security (Azure, AWS, GCP)

Executive communication

Education

Bachelor's degree in CS/IT

Tools

Splunk

Sentinel

Carbon Black

Job description

WTW is seeking an experienced Cyber Security Incident Response IR Manager to lead complex security incidents within the ICSD function. You will establish incident response procedures, coordinate with SOC, Threat Hunting, CTI, and Insider Threat teams, and liaise with HR, Legal, and Compliance to ensure effective incident management.

The role requires 7+ years in incident response, strong forensic and SIEM/EDR skills, and the ability to communicate effectively with executives.