Incident Response Lead

TCC Toyota Motor Credit Corporation Company; Plano (TX); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Health care and wellness plans

401(k) with company match

Tuition reimbursement

Team Member Vehicle Purchase Discount

Job summary

Toyota Financial Services (TFS) Technology team seeks an experienced Post Incident Review Lead to oversee the PIR process for cybersecurity events. You will manage the PIR team, ensure thorough investigations, and drive improvements across incident analysis, playbooks, and training.

The role requires 7+ years in information security, strong leadership, and fluency with MITRE ATT&CK, SIEM platforms, and regulatory standards. Plano, TX-based with competitive benefits.

Qualifications

• Bachelor’s degree in computer science, information security, or related field; or equivalent experience.
• 7+ years in information security with incident response exposure.
• Proven leadership managing technical and/or non-technical teams.
• Strong experience with MITRE ATT&CK and root cause analysis.
• Knowledge of ISO 27001, NIST, SOX and regulatory requirements.
• Certs: CISSP, GCIH, GSEC, OSCP, CYSA+ are a plus.

Responsibilities

• Lead and manage the Post Incident Review team, providing mentorship and performance guidance.
• Oversee post-incident investigations to ensure thorough root cause analysis and remediation recommendations.
• Collaborate with Security Operations, IT, Risk Management, business units, and executives to communicate findings and drive resolution.
• Develop and refine PIR frameworks, methodologies, and tools to improve incident analysis efficiency.
• Facilitate lessons learned sessions and integrate insights into playbooks, SOPs, and training.

Skills

Incident response leadership

Root cause analysis

MITRE ATT&CK framework

SIEM expertise (Splunk Exabeam)

Executive communication

Education

Bachelor’s degree in Computer Science or Information Security

Master’s degree in Cyber Security (bonus)

Tools

Splunk

Exabeam

Job description

Overview Who we are

Collaborative. Respectful. A place to dream and do. These are just a few words that describe what life is like at Toyota. As one of the world’s most admired brands, Toyota is growing and leading the future of mobility through innovative, high-quality solutions designed to enhance lives and delight those we serve. We're looking for talented team members who want to Dream. Do. Grow. with us. An important part of the Toyota family is Toyota Financial Services (TFS), the finance and insurance brand for Toyota and Lexus in North America. While TFS is a separate business entity, it is an essential part of this world-changing company- delivering on Toyota's vision to move people beyond what's possible. At TFS, you will help create best-in-class customer experience in an innovative, collaborative environment.

Toyota does not offer support or sponsorship of job applicants for employment-based visas or any other work authorization for this role now or in the future. You must have the right to work in the United States and not require Toyota support or sponsorship for immigration-related employment (e.g., H-1B, O-1, E-3, H-1B1, TN, F-1 OPT, F-1 STEM, OPT, F-1 CPT, 'job flexibility benefits' [also known as I-140 or Adjustment of Status portability], etc.) now or in the future. You should not apply for this role if you will require Toyota to assist with immigration support or sponsorship now or in the future.

Who we're looking for

Toyota Financial Services (TFS) Technology team is seeking an experienced and proactive Post Incident Review Lead to oversee and drive the post-incident review process for cybersecurity events and incidents. This leadership role is responsible for managing the PIR team, ensuring thorough analysis of security incidents, driving continuous improvement in post incident review, and collaborating with senior stakeholders to strengthen Toyota’s cybersecurity posture.

What you'll be doing

• Lead and manage the Post Incident Review team, providing guidance, mentorship, and performance management to senior and junior analysts


• Oversee all post-incident investigations to ensure comprehensive root cause analysis, impact assessment, and actionable remediation recommendations


• Collaborate closely with Security Operations, IT, Risk Management, Business Units, and executive leadership to communicate findings and drive resolution


• Develop and enhance post-incident review frameworks, methodologies, and tools to improve efficiency and effectiveness of incident analysis


• Facilitate lessons learned sessions and ensure key insights are integrated into incident response playbooks, SOPs, and training programs


• Identify systemic risks and trends from incident data to inform strategic risk mitigation and security program enhancements


• Ensure compliance with regulatory requirements and internal policies through detailed documentation and audit support


• Drive continuous improvement initiatives in incident response processes based on evolving threat landscape and industry best practices


• Represent the PIR function in cross-functional security governance forums and contribute to enterprise-wide cybersecurity strategy

What you bring

• Bachelor’s degree in computer science, Information Security, or related field, or equivalent experience


• 7+ years of progressive experience in Information Security with significant exposure to incident response and post-incident review activities


• Proven leadership experience managing technical and/or non-technical teams in a cybersecurity environment


• Strong expertise in root cause analysis, incident timeline reconstruction, and application of frameworks such as MITRE ATT&CK


• Deep understanding of Cyber Threat TTPs, threat hunting techniques, and enterprise SIEM/security analytics platforms (e.g., Splunk, Exabeam)


• Excellent communication skills with ability to translate complex technical findings for diverse audiences including executives


• Experience developing and refining SOPs, playbooks, and training materials for post incident review or incident response programs


• Familiarity with security frameworks such as ISO 27001, NIST, SOX, and regulatory compliance requirements


• Added bonus if you have Master's degree in Cyber Security, Computer Science, Statistics, or related field


• Experience in the financial services, banking, or insurance industry


• Relevant certifications (e.g., CISSP, GCIH, GSEC, OSCP, CYSA+)

What we'll bring

During your interview process, our team can fill you in on all the details of our industry-leading benefits and career development opportunities. A few highlights include:

• A work environment built on teamwork, flexibility, and respect


• Professional growth and development programs to help advance your career, as well as tuition reimbursement


• Team Member Vehicle Purchase Discount


• Toyota Team Member Lease Vehicle Program (if applicable)


• Comprehensive health care and wellness plans for your entire family


• Toyota 401(k) Savings Plan featuring a company match, as well as an annual retirement contribution from Toyota regardless of whether you contribute (if applicable)


• Paid holidays and paid time off

Belonging at Toyota

Our success begins and ends with our people. We embrace all perspectives and value unique human experiences. Respect for all is our North Star. Applicants for our positions are considered without regard to race, ethnicity, national origin, sex, sexual orientation, gender identity or expression, age, disability, religion, military or veteran status, or any other characteristics protected by law.

Career Possibilities

We encourage innovation and look for people who will challenge the status quo in order to make the world a better place. We thrive on teamwork and collaboration and know diverse backgrounds, experiences and perspectives are not only the right thing for our people, they are a business imperative. Together, we're empowered to forge our own paths — to be agile, curious and embrace a growth mindset and immerse ourselves in situations to gain new perspectives and to inspire bold, innovative ways of thinking and working. Our success as a company is directly tied to our team members' success, and our collective ability to give back to society through an unwavering commitment to delight our customers and make people’s lives better. If you want to be part of the next-generation of innovations that help keep the world moving, then join us. And let's start our impossible, together.