Cyber Incident Commander & Security Crisis Leader

Lowe's; Charlotte (NC); On-site; USD 140,000 - 190,000; Full time

Job summary

Lowe's in Charlotte seeks an experienced Lead Analyst to drive end-to-end cyber incident management. You will coordinate across Security Operations, Threat Intelligence, DFIR, and business teams to contain, eradicate, and recover from major incidents, while delivering timely executive briefings and post-incident reviews.

The role requires strong leadership, deep incident response expertise, and the ability to translate complex findings into business risk for senior leadership.

Qualifications

• 7-10+ years in cybersecurity with leadership in incidents
• Strong knowledge of SIEM, SOAR, EDR/XDR, IAM, cloud security and threat intel
• Experience managing high-severity, enterprise-scale incidents
• Familiarity with NIST, SANS, MITRE ATT&CK frameworks
• Experience with AWS/Azure/GCP cloud environments
• Excellent crisis leadership and stakeholder management
• Ability to translate technical findings into business risk communications
• Strong documentation, analytical, and problem-solving skills
• Ability to manage multiple priorities during critical incidents

Responsibilities

• Lead and coordinate response to high-severity cybersecurity incidents.
• Own the security incident management lifecycle from identification to recovery.
• Establish incident severity, business impact, escalation paths and priorities.
• Act as Incident Commander for major incidents and coordinate teams.
• Maintain timelines, logs, evidence, and documentation throughout events.
• Provide executive-level incident reporting and briefings to leadership.
• Coordinate with Legal, Privacy, Risk, HR, Communications on regulatory implications.
• Facilitate incident war rooms and maintain command-and-control discipline.
• Ensure smooth handoffs between SOC, DFIR, engineering, cloud and apps teams.
• Lead post-incident reviews and track remediation actions to closure.
• Identify recurring patterns and recommend improvements to controls and automation.
• Develop and maintain IR plans, playbooks, and tabletop exercises.
• Track metrics like MTTD, MTTA, MTTR and SLA adherence.
• Support regulatory, audit, cyber insurance, and compliance needs.
• Drive automation and AI-enabled investigation where appropriate

Skills

Security Operations

Incident Response

DFIR

Threat Management

MITRE ATT&CK

Cloud Security

Leadership

Communication

Documentation

Crisis Management

Tools

SIEM/SOAR

EDR/XDR

IAM

Cloud Platforms

Forensics Tools

Job description

Lowe's in Charlotte seeks an experienced Lead Analyst to drive end-to-end cyber incident management. You will coordinate across Security Operations, Threat Intelligence, DFIR, and business teams to contain, eradicate, and recover from major incidents, while delivering timely executive briefings and post-incident reviews.

The role requires strong leadership, deep incident response expertise, and the ability to translate complex findings into business risk for senior leadership.