Incident Response Coordinator, Senior

asmexternalcareersite; United States; Remote; USD 120,000 - 170,000; Full time

Job summary

ASM Research in the United States is seeking an Incident Response Coordinator, Senior to lead tactical coordination of complex IT incidents, drive war rooms, and ensure timely executive communications during major events. You will enforce runbooks and cadence while collaborating with cyber defenders and ITSM governance.

Responsibilities focus on structured playbooks, escalation matrices, and audit-ready documentation, with emphasis on readiness, drills, mentoring, and evidence trails to support

Qualifications

• Bachelor’s degree in IT or related field, or equivalent relevant work experience.
• 8+ years of incident management, incident response, or related IT roles, including leadership of major incidents in large, complex enterprise or federal IT environments.
• Deep understanding of ITIL principles and advanced incident management and response best practices, including governance of runbooks, escalation models, and communications.
• Demonstrated proficiency with incident management tools, IT service management platforms, and monitoring solutions used to manage major incidents and produce operational and executive reporting.
• Excellent problem‑solving, analytical, written, and verbal communication skills, with proven ability to brief senior leadership and translate technical risk into business terms.
• Demonstrated ability to lead multiple concurrent complex incidents, make timely decisions with incomplete information, and drive consensus across diverse technical and business stakeholders.
• Active SECRET clearance or ability to obtain and maintain required background investigation; U.S. citizenship required.

Responsibilities

• War-Room Facilitation: Structure/facilitate major incident bridges; maintain restoration focus; assign actions/owners; track progress to closure; enforce decision/messaging cadence.
• Process Execution & Standards: Maintain/enforce incident playbooks, escalation matrices, and communication templates; ensure ITSM record quality, CI linkage, and documentation discipline.
• Value-Stream Awareness: Engage dependencies early based on service mapping; identify/remove bottlenecks delaying restoration.
• Communications: Produce leadership updates/executive briefings translating technical impact/risk/remediation into clear business language; maintain SSOT.
• Cross-Practice Integration: Coordinate with Problem, Change, Release, Service Continuity, and SOC/Cyber IR; support PIRs and trend analysis.
• Readiness & Drills: Run tabletop exercises; review playbooks; audit on-call readiness; ensure consistent execution across shifts/teams.
• Mentoring: Coach coordinators/junior IM staff on escalation protocols, communication discipline, and analysis techniques.
• Evidence & Audit Trail: Ensure timelines, key decisions, and impact assessments are documented and stored to meet compliance and audit requirements.

Skills

Incident management

ITIL knowledge

Executive communication

Leadership

Cross-team collaboration

Education

Bachelor’s degree in IT/CS/BA or related

Tools

Incident management tools

ITSM platforms

Monitoring solutions

Job description

The Incident Response Coordinator, Senior leads tactical coordination of complex IT incidents to minimize mission impact. The role facilitates disciplined war rooms, enforces cadence and runbooks, drives cross-team collaboration, and provides executive‑ready communications during and after major events. This role executes the incident response process as defined by enterprise ITSM governance and the Senior Incident Manager, integrates with cyber defenders when needed, and champions readiness and continual improvement.

Key Responsibilities

• War-Room Facilitation: Structure/facilitate major incident bridges; maintain restoration focus; assign actions/owners; track progress to closure; enforce decision/messaging cadence.
• Process Execution & Standards: Maintain/enforce incident playbooks, escalation matrices, and communication templates; ensure ITSM record quality, CI linkage, and documentation discipline.
• Value-Stream Awareness: Engage dependencies (infra, app, identity, cloud, network) early based on service mapping; identify/remove bottlenecks delaying restoration (approvals, routing).
• Communications: Produce leadership updates/executive briefings translating technical impact/risk/remediation into clear business language; maintain SSOT.
• Cross-Practice Integration: Coordinate with Problem, Change, Release, Service Continuity, and SOC/Cyber IR where service impact/security intersects; support PIRs and trend analysis.
• Readiness & Drills: Run tabletop exercises; review playbooks; audit on-call readiness; ensure consistent execution across shifts/teams.
• Mentoring: Coach coordinators/junior IM staff on escalation protocols, communication discipline, and analysis techniques.
• Evidence & Audit Trail: Ensure timelines, key decisions, and impact assessments are documented and stored to meet compliance and audit requirements.

Required Qualifications

• Bachelor’s degree in Information Technology, Computer Science, Business Administration, or related field, or equivalent relevant work experience.
• 8+ years of experience in incident management, incident response, or related IT roles, including leadership of major incidents in large, complex enterprise or federal IT environments.
• Deep understanding of ITIL principles and advanced incident management and response best practices, including governance of runbooks, escalation models, and communications.
• Demonstrated proficiency with incident management tools, IT service management platforms, and monitoring solutions used to manage major incidents and produce operational and executive reporting.
• Excellent problem‑solving, analytical, written, and verbal communication skills, with proven ability to brief senior leadership and translate technical risk into business terms.
• Demonstrated ability to lead multiple concurrent complex incidents, make timely decisions with incomplete information, and drive consensus across diverse technical and business stakeholders.
• Active SECRET clearance or ability to obtain and maintain required background investigation; U.S. citizenship required.

Preferred Qualifications

• Leadership experience in enterprise-scale or defense-related major incident management, including coordination with external partners or multi‑agency stakeholders.
• Advanced incident management or cybersecurity certifications (such as ITIL intermediate/advanced or incident‑response-oriented credentials).
• Experience designing or maturing enterprise incident response frameworks, including integration with cyber defense centers, problem management, and governance processes.

Compensation Ranges

Compensation ranges for ASM Research positions vary depending on multiple factors; including but not limited to, location, skill set, level of education, certifications, client requirements, contract-specific affordability, government clearance and investigation level, and years of experience. The compensation displayed for this role is a general guideline based on these factors and is unique to each role. Monetary compensation is one component of ASM's overall compensation and benefits package for employees.

EEO Requirements

It is the policy of ASM that an individual's race, color, religion, sex, disability, age, sexual orientation or national origin are not and will not be considered in any personnel or management decisions. We affirm our commitment to these fundamental policies.

All recruiting, hiring, training, and promoting for all job classifications is done without regard to race, color, religion, sex, disability, or age. All decisions on employment are made to abide by the principle of equal employment.

Physical Requirements

The physical requirements described in "Knowledge, Skills and Abilities" above are representative of those which must be met by an employee to successfully perform the primary functions of this job. (For example, "light office duties" or "lifting up to 50 pounds" or "some travel" required.) Reasonable accommodations may be made to enable individuals with qualifying disabilities, who are otherwise qualified, to perform the primary functions.

Disclaimer

The preceding job description has been designed to indicate the general nature and level of work performed by employees within this classification. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications required of employees assigned to this job.