Incident Response Manager - Lead & Evolve Security

10 Ancestry.com Operations Inc.; Draper (UT); Hybrid; USD 132,000 - 166,000; Full time

Job summary

Ancestry is seeking a battle-tested Manager, Incident Response to lead and mature our IR team. You will mentor responders, threat hunters, and forensic analysts, driving strategic capabilities to quickly detect, contain, and eradicate threats across a modern infrastructure.

You will manage end-to-end incident handling, build runbooks, and leverage automation to shorten containment times, while communicating risk to leadership and stakeholders.

Qualifications

• 3+ years of people management in incident response.
• 6+ years in enterprise-scale incident response, forensics, blue team operations.
• Strong leadership and crisis management under high-stress incidents.
• Deep understanding of attacker TTPs and MITRE ATT&CK mapping.
• Familiarity with AI tools to augment security workflows.

Responsibilities

• Lead and mentor IR engineers and threat hunters; foster psychological safety.
• Oversee end-to-end incident handling for complex enterprise incidents.
• Define and track incident metrics, report risk-focused updates to leadership.
• Coordinate crisis communication with leadership, legal, and PR teams.
• Drive post-incident reviews and improvements to detections and processes.
• Develop and mature IR runbooks; push automation to reduce containment times.

Skills

People management

Incident response

Threat hunting

Crisis management

AI tools familiarity

MITRE ATT&CK knowledge

Tools

EDR/XDR tools

AWS security fundamentals

SIEM & logging

SOAR & automation

Forensics tools

Job description

Ancestry is seeking a battle-tested Manager, Incident Response to lead and mature our IR team. You will mentor responders, threat hunters, and forensic analysts, driving strategic capabilities to quickly detect, contain, and eradicate threats across a modern infrastructure.

You will manage end-to-end incident handling, build runbooks, and leverage automation to shorten containment times, while communicating risk to leadership and stakeholders.