Global Cloud Incident Response Lead

WTW; New York (NY); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Health and Welfare Benefits

Paid time off

Retirement benefits

Job summary

WTW is seeking a highly experienced Cyber Security Incident Response IR Manager to lead the response to complex security incidents within the Global Information and Cyber Security Defence (ICSD) function. The role requires 7+ years in incident response, hands-on expertise with SIEM/EDR and cloud environments, and the ability to drive playbooks and post-incident reviews across a multinational organization.

You will coordinate with SOC, Threat Hunting, CTI, Insider Threat, HR, Legal, and

Qualifications

• Minimum 7 years of experience in incident response and cybersecurity
• Experience with SIEM tools, EDR platforms, and threat intelligence integration
• Strong ability to lead high-stakes security incidents and coordinate cross-functional teams
• Knowledge of MITRE ATT&CK, cyber kill chain, and IR methodologies
• Excellent verbal and written communication, including executives

Responsibilities

• Serve as the primary lead for significant security incidents, coordinating response across technical and business teams.
• Lead cross-cloud IR workflows, including Azure, AWS, and GCP, for rapid containment and remediation.
• Coordinate with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability teams for seamless incident response.
• Develop and maintain incident response processes, playbooks, and workflows aligned with best practices.
• Mentor junior analysts and conduct tabletop exercises to improve preparedness.

Skills

Incident response

Forensic analysis

Malware analysis

SIEM

EDR

Threat intelligence

MITRE ATT&CK

Executive communication

Leadership

Cross-functional coordination

Mentoring

Tools

Sentinel

Splunk

Carbon Black

Job description

WTW is seeking a highly experienced Cyber Security Incident Response IR Manager to lead the response to complex security incidents within the Global Information and Cyber Security Defence (ICSD) function. The role requires 7+ years in incident response, hands-on expertise with SIEM/EDR and cloud environments, and the ability to drive playbooks and post-incident reviews across a multinational organization.

You will coordinate with SOC, Threat Hunting, CTI, Insider Threat, HR, Legal, and