Cyber Incident Response Lead

Toyota; Plano (TX); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Health care benefits

Tuition reimbursement

Vehicle discount programs

Retirement plan

Job summary

Toyota Financial Services (TFS) Technology seeks a Cyber Incident Response Lead to guide responses to cybersecurity events. This leadership role oversees response activities, coordinates with stakeholders, and strengthens Toyota’s posture through containment, investigation, escalation, and resolution of security incidents.

The ideal candidate has 7+ years in information security, proven leadership, strong communication, and expertise in MITRE ATT&CK, SIEM tools, and incident playbooks.

Qualifications

• Bachelor’s degree or equivalent experience in information security or related field.
• 7+ years of progressive information security experience with incident response.
• Proven leadership managing technical and/or non-technical teams.
• Strong root-cause analysis, incident timeline reconstruction, MITRE ATT&CK fluency.
• Deep understanding of cyber threats, SIEM analytics, and risk management.
• Excellent communication to executives and diverse stakeholders.
• Experience creating SOPs, playbooks, and training materials.
• Familiarity with ISO 27001, NIST, SOX and regulatory requirements.
• Relevant certifications preferred (CISSP, GCIH, GSEC, OSCP, CYSA+).

Responsibilities

• Lead incident response investigations and provide guidance to analysts.
• Oversee triage, containment, analysis, escalation, and remediation.
• Collaborate with Security Operations, IT, Risk, and leaders to drive resolution.
• Develop and refine incident response playbooks and tools.
• Facilitate lessons learned and integrate insights into programs.
• Identify systemic risks and inform security program enhancements.
• Ensure regulatory and internal policy compliance with documentation.
• Drive continuous improvement in response processes and governance.
• Represent IR in cross-functional security forums and strategy discussions.

Skills

Leadership

Incident response

Threat hunting

Communication

SOP development

Education

Bachelor's degree in Computer Science or related field

Tools

MITRE ATT&CK

Splunk

Exabeam

Job description

Overview

Who we are

Collaborative. Respectful. A place to dream and do. These are just a few words that describe what life is like at Toyota. As one of the world’s most admired brands, Toyota is growing and leading the future of mobility through innovative, high-quality solutions designed to enhance lives and delight those we serve. We’re looking for talented team members who want to Dream. Do. Grow. with us.

An important part of the Toyota family is Toyota Financial Services (TFS), the finance and insurance brand for Toyota and Lexus in North America. While TFS is a separate business entity, it is an essential part of this world-changing company- delivering on Toyota's vision to move people beyond what's possible. At TFS, you will help create best-in-class customer experience in an innovative, collaborative environment.

Toyota does not offer support or sponsorship of job applicants for employment-based visas or any other workauthorization for this role now or in the future. You must have the right to work in the United States and not requireToyota support or sponsorship for immigration-related employment (e.g., H-1B, O-1, E-3, H-1B1, TN, F-1 OPT, F-1 STEM, OPT, F-1 CPT, ‘job flexibility benefits’ [also known as I-140 or Adjustment of Status portability], etc.) now or in thefuture. You should not apply for this role if you will require Toyota to assist with immigration support or sponsorshipnow or in the future.

Who we're looking for

Toyota Financial Services (TFS) Technology is seeking an experienced and proactive Cyber Incident Response Lead to guide the response to cybersecurity events and incidents. This leadership role is responsible for overseeing incident response activities, coordinating across key stakeholders, and strengthening Toyota’s cybersecurity posture through effective containment, investigation, escalation, and resolution of security incidents.

What you'll be doing

• This is an individual contributor role, leading incident response investigations, providing guidance, mentorship, and performance management to analysts and team members.
• Oversee cybersecurity incident investigations to ensure effective triage, containment, analysis, escalation, and remediation.
• Collaborate closely with Security Operations, IT, Risk Management, Business Units, and executive leadership to communicate findings and drive resolution.
• Develop and enhance incident response frameworks, methodologies, and tools to improve efficiency and effectiveness.
• Facilitate lessons learned sessions and ensure key insights are integrated into incident response playbooks, SOPs, and training programs.
• Identify systemic risks and trends from incident data to inform strategic risk mitigation and security program enhancements.
• Ensure compliance with regulatory requirements and internal policies through detailed documentation and audit support.
• Drive continuous improvement initiatives in incident response processes based on the evolving threat landscape and industry best practices.
• Represent the incident response function in cross-functional security governance forums and contribute to enterprise-wide cybersecurity strategy.

What you bring

• Bachelor’s degree in Computer Science, Information Security, or a related field, or equivalent experience.
• 7+ years of progressive experience in Information Security with significant exposure to incident response activities.
• Proven leadership experience managing technical and/or non-technical teams in a cybersecurity environment.
• Strong expertise in root cause analysis, incident timeline reconstruction, and application of frameworks such as MITRE ATT&CK.
• Deep understanding of cyber threat TTPs, threat hunting techniques, and enterprise SIEM/security analytics platforms such as Splunk or Exabeam.
• Excellent communication skills with the ability to translate complex technical findings for diverse audiences, including executives.
• Experience developing and refining SOPs, playbooks, and training materials for incident response programs.
• Familiarity with security frameworks such as ISO 27001, NIST, SOX, and regulatory compliance requirements.
• Relevant certifications preferred, such as CISSP, GCIH, GSEC, OSCP, or CYSA+.

Added bonus if you have

• Master's degree in cyber security, Computer Science, Statistics, or related field
• Experience in the financial services, banking, or insurance industry
• Relevant certifications (e.g., CISSP, GCIH, GSEC, OSCP, CYSA+)

What we’ll bring

During your interview process, our team can fill you in on all the details of our industry-leading benefits and careerdevelopment opportunities. A few highlights include:

• A work environment built on teamwork, flexibility, and respect
• Professional growth and development programs to help advance your career, as well as tuition reimbursement
• Team Member Vehicle Purchase Discount
• Toyota Team Member Lease Vehicle Program (if applicable)
• Comprehensive health care and wellness plans for your entire family
• Toyota 401(k) Savings Plan featuring a company match, as well as an annual retirement contribution from Toyotaregardless of whether you contribute (if applicable)
• Paid holidays and paid time off

Belonging at Toyota

Our success begins and ends with our people. We embrace all perspectives and value unique human experiences. Respect for all is our North Star.

Applicants for our positions are considered without regard to race, ethnicity, national origin, sex, sexual orientation, gender identity or expression, age, disability, religion, military or veteran status, or any other characteristics protected by law.