Head of Cybersecurity Incident Response

Genworth Financial, Inc.; Richmond (VA); Hybrid; USD 121,000 - 187,000; Full time

Benefits offered by this job

Competitive compensation

401(k) match

Paid time off

Wellness programs

Job summary

Genworth Financial, Inc. is seeking a Lead, Security Operations in Richmond, VA hybrid. You will head CSIRT, drive enterprise-wide cybersecurity incident response, and coach a technical team through planning, detection, containment, and recovery to minimize business disruption.

The role demands strong leadership, deep incident expertise, and collaboration with Legal, Privacy, Compliance, Risk, and Communications to align response with business needs and regulatory requirements.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field, or 7+ years of equivalent relevant experience.
• Significant progressive experience in cybersecurity operations and incident response, including leadership of a CSIRT or comparable response function.
• Demonstrated experience directing complex cybersecurity incidents and coordinating response across technical teams, business stakeholders, and external partners.
• Strong technical knowledge of incident investigation, containment, eradication, and recovery across endpoint, network, identity, and cloud environments.
• Experience with security monitoring and investigation technologies, including SIEM, EDR, and security orchestration and automation tools.

Responsibilities

• Lead the Computer Security Incident Response Team (CSIRT), setting priorities, developing team capabilities, and establishing clear accountability for incident readiness and response.
• Direct cybersecurity incident response from initial triage and investigation through containment, eradication, recovery, and post-incident review.
• Coordinate broader incident response efforts across Cybersecurity, Technology, business teams, and external partners, ensuring clear ownership, timely escalation, and effective hand-offs.
• Maintain and enhance incident response plans, playbooks, severity criteria, and escalation procedures to support consistent execution.
• Serve as a primary escalation point for significant cybersecurity incidents, translating technical findings into clear business impacts, response options, and leadership updates.
• Partner with Legal, Privacy, Compliance, Risk, Communications, and Business Continuity teams to support incident decisions, notification assessments, and recovery coordination.
• Guide incident investigations, including evidence preservation, forensic analysis, and documentation, engaging specialized internal resources and external providers as needed.
• Lead tabletop exercises and response simulations to test readiness, clarify responsibilities, and address gaps before incidents occur.
• Use incident trends, threat intelligence, and lessons learned to strengthen detection and response capabilities, improve playbooks, and reduce recurring issues.
• Establish response metrics and reporting, oversee incident response service providers, and drive improvements in response speed, quality, and operational resilience.
• Leverage AI and automation to identify and respond to cybersecurity threats at machine speed.

Skills

CSIRT leadership

Cybersecurity operations

Incident response

Communication to senior leaders

Threat intelligence

Incident investigations

Forensics basics

Education

Bachelor’s degree in Cybersecurity/CS/IT or 7+ years related exp.

Tools

SIEM

EDR

SOAR tools

Job description

Genworth Financial, Inc. is seeking a Lead, Security Operations in Richmond, VA hybrid. You will head CSIRT, drive enterprise-wide cybersecurity incident response, and coach a technical team through planning, detection, containment, and recovery to minimize business disruption.

The role demands strong leadership, deep incident expertise, and collaboration with Legal, Privacy, Compliance, Risk, and Communications to align response with business needs and regulatory requirements.