Incident Response Manager: Lead Detection & Remediation

HUB International; Chicago (IL); On-site; USD 130,000 - 150,000; Full time

Benefits offered by this job

Health/dental/vision insurance

Life insurance

Disability insurance

401(k) and matching

Job summary

HUB International is seeking a seasoned Security Incident Response Manager to lead a dedicated IR team. You will own the incident lifecycle—from detection and triage to containment, eradication, recovery, and post-incident review—while guiding proactive detection engineering and threat hunting.

You will mentor staff, improve processes, and ensure log analysis across cloud and on-prem environments. Strong DFIR experience and KPI focus are essential.

Qualifications

• Bachelor’s degree in technology or applicable experience.
• 10+ years programming/scripting experience; strong knowledge of TCP/IP, DNS, HTTP, WAF, OAuth, SAML.
• 5+ years with Active Directory/Entra and O365 services.
• 5+ years with security platforms, automation tooling; hands-on with SIEM, EDR, SOAR.
• Experience in DFIR, logs, timelines, evidence handling with chain-of-custody.
• Familiarity with NIST/SANS incident response frameworks; KPI-driven maturity.
• Proven ability to build or mature an IR team; strong collaboration & adaptability.

Responsibilities

• Lead and manage a Security Incident Response Team focused on threat detection and response.
• Oversee end-to-end incident response lifecycle from detection to post-incident review.
• Mentor team members and drive continuous improvement in processes and tooling.
• Analyze cloud/on-prem logs, perform forensics, and determine scope of impact.
• Develop scalable incident response playbooks and escalation frameworks.
• Report KPIs and coordinate with stakeholders on incident status.

Skills

Powershell

Python

Shell scripting

Networking basics

Education

Bachelor’s degree in technology or applicable experience

Tools

SIEM

EDR

SOAR

Microsoft 365 / Entra

Job description

HUB International is seeking a seasoned Security Incident Response Manager to lead a dedicated IR team. You will own the incident lifecycle—from detection and triage to containment, eradication, recovery, and post-incident review—while guiding proactive detection engineering and threat hunting.

You will mentor staff, improve processes, and ensure log analysis across cloud and on-prem environments. Strong DFIR experience and KPI focus are essential.