Cyber Security Incident Response - IR Manager

WTW; United States; On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Health benefits

Paid time off

Retirement plan

Job summary

WTW is seeking a Cyber Security Cloud Incident Response IR Manager to lead the incident response program across cloud environments. You will coordinate with SOC, Threat Hunting, CTI, and other teams to contain, eradicate, and recover from incidents, while communicating with executives, Legal, HR, and Compliance.

You will mentor analysts, develop playbooks, and refine processes. The role partners with MSSPs to strengthen security posture against evolving threats in a hybrid environment.

Qualifications

• Minimum 7 years of incident response experience with strong cybersecurity fundamentals.
• Proficient in forensic analysis, malware analysis, and network traffic analysis.
• Experience with SIEM tools, EDR platforms, and threat intelligence integration.
• Ability to lead high-stakes incidents and coordinate cross-functional teams.
• Deep knowledge of MITRE ATT&CK, cyber kill chain, and IR methodologies.
• Excellent verbal and written communication, including executives.
• Experience with Sentinel, Splunk, Carbon Black is preferred.
• Mentoring and tabletop exercises to improve team readiness.

Responsibilities

• Lead significant security incidents as primary IR lead, coordinating across teams.
• Drive cross-cloud IR workflows and forensic investigations across hybrid environments.
• Lead global response teams and integrate SIEM/SOAR platforms with MSSPs.
• Establish, refine incident response processes, playbooks, and workflows.
• Serve as central contact for incident activities with Legal, HR, Compliance, and leadership.
• Lead root cause analysis and post-incident reviews to strengthen defenses.
• Collaborate with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability Management.
• Develop automation scripts and workflows to boost detection and response.
• Contribute to KPIs and metrics to measure IR effectiveness.
• Maintain incident handling records and ensure policy/audit alignment.

Skills

Incident response leadership

Cybersecurity principles

Communication skills

Mentoring

Regulatory compliance

Education

CISSP

GCIH

GCFA

CISM

Tools

Sentinel

Splunk

Carbon Black

Job description

The Cyber Security Cloud Incident Response IR Manager will play a key role in managing and responding to security incidents within WTW’s Cyber Security Incident Response Team. Responsibilities of this role will include:

• Serve as the primary lead for significant security incidents, coordinating response efforts across technical and business teams to minimize impact and ensure timely resolution.
• Seasoned Cloud Security Incident Response leader with deep expertise in Azure, AWS, and GCP, driving rapid containment and remediation of complex threats across hybrid environments.
• Proven track record in orchestrating cross-cloud IR workflows and forensic investigations, ensuring resilient security posture and regulatory compliance.
• Adept at leading global response teams, integrating SIEM/SOAR platforms, and collaborating with MSSPs to mitigate cloud-native and supply chain attack
• Establish, refine, and maintain incident response processes, playbooks, and workflows to align with industry best practices and WTW’s organizational needs.
• Act as the central point of contact for incident response activities, ensuring effective communication with internal and external stakeholders, including senior leadership, Legal, HR, and Compliance teams.
• Lead the in-depth technical investigation of security incidents escalated from the SOC, ensuring timely containment, eradication, and recovery while identifying root causes and potential impact
• Work closely with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability Management teams to ensure seamless coordination and information sharing during incidents.
• Lead root cause analysis and post-incident reviews to identify gaps, implement lessons learned, and enhance the overall incident response program.
• Provide mentorship and guidance to junior analysts and conduct tabletop exercises to improve team preparedness.
• Stay informed about emerging threats, attack trends, and evolving threat actor tactics, techniques, and procedures (TTPs) to ensure proactive Defense.
• Ensure incident handling complies with relevant regulations and prepare detailed reports for regulatory or internal purposes.
• Evaluate and prioritize incidents based on potential impact and severity, escalating issues to higher levels of management or other teams as required.
• Assist in developing and fine-tuning automation scripts and workflows to enhance incident detection and response efficiency.
• Contribute to the development and maintenance of key performance indicators (KPIs) and metrics to measure the effectiveness of incident response processes.
• Act as a liaison between technical teams and business stakeholders, ensuring clear communication during incidents and status updates.
• Maintain up-to-date records of all incident handling activities in incident management systems, ensuring alignment with internal policies and audit requirements.

The Requirements

• Minimum 7 years of experience in incident response, with a strong understanding of cybersecurity principles, frameworks, and tools.
• Proficient in forensic analysis, malware analysis, and network traffic analysis. Experience with SIEM tools, EDR platforms, and threat intelligence integration is essential.
• Proven ability to lead high-stakes security incidents and coordinate cross-functional teams effectively.
• Deep understanding of MITRE ATT&CK, cyber kill chain, and incident response methodologies.
• Exceptional verbal and written communication skills, with the ability to convey complex technical concepts to non-technical audiences, including executives.
• Industry certifications such as CISSP, GCIH, GCFA, or CISM are highly preferred.
• Experience with platforms like Sentinel, Splunk, Carbon Black, or similar technologies.
• A proactive and decisive mindset with the ability to operate under pressure.
• Strong analytical and problem-solving skills to make informed decisions in complex situations.
• Collaborative and adaptable, with a passion for mentoring and developing team members.

Note: Employment-based non-immigrant visa sponsorship and/or assistance is not offered for this specific job opportunity.

Compensation and Benefits

Base salary range and benefits information for this position are being included in accordance with requirements of various state/local pay transparency legislation. Please note that salaries may vary for different individuals in the same role based on several factors, including but not limited to location of the role, individual competencies, education/professional certifications, qualifications/experience, performance in the role and potential for revenue generation (Producer roles only).

Compensation

The base salary compensation range being offered for this role is $120,000.00-$180,000.00 USD annually. This role is also eligible for an annual short-term incentive bonus.

Company Benefits

WTW provides a competitive benefit package which includes the following (eligibility requirements apply):

• Health and Welfare Benefits: Mental health/emotional wellbeing (including Employee Assistance Program), medical (including prescription drug coverage and fertility benefits), dental, vision, Health Savings Account, Commuter Accounts, Health Care and Dependent Care Flexible Spending Accounts, company-paid life insurance, supplemental life insurance, AD&D, group accident, group critical illness, group legal, identify theft protection, wellbeing program, adoption assistance, surrogacy assistance, auto/home insurance, pet insurance and other work/life resources
• Leave Benefits: Paid holidays, annual paid time off (includes state/local paid leave where required), company-paid disability (short-term and long-term disability), other leaves (e.g., bereavement, FMLA, ADA, jury duty, military leave, and Parental and Adoption Leave), Paid Time Off (only included for Washington roles)
• Retirement Benefits: Qualified contributory pension plan (if eligible) and 401(k) plan with annual nonelective company contribution. Non-qualified retirement plans available to senior level colleagues who satisfy the plans’ eligibility requirements.

Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles County Fair Chance Ordinance for Employers, we will consider for employment qualified applicants with arrest and conviction records.

This position will remain posted for a minimum of three business days from the date posted or until sufficient/appropriate candidate slate has been identified.