Incident Response Program Lead

Iseatz; United States; Remote; USD 146,000 - 155,000; Full time

Benefits offered by this job

Health insurance

401(k) with company matching

Generous PTO

Paid parental leave

Remote-first culture

Professional development allowance

Job summary

iSeatz is seeking an experienced Incident Response Program Lead to own and advance our security incident response program. You will coordinate responses to security incidents, oversee MSSP governance, and drive improvements in detection, automation, and readiness across technical and business teams.

You will partner with the Information Security Manager and cross-functional partners to translate security risks into clear business actions, lead tabletop exercises, and contribute to risk

Qualifications

• Five or more years of information security experience focused on incident response and security operations.
• Proven ability to lead or coordinate security incidents across technical and business teams.
• Experience developing, maintaining, and testing incident response plans and playbooks.
• Experience working with MSSP, MDR, SOC, or similar security partners.
• Knowledge of security monitoring, SIEM, cloud security, vulnerability management, IAM, and network security.
• Experience with cloud environments, especially AWS, and multi-account architectures.
• Familiarity with NIST CSF, NIST SP 800-61, and SANS incident response processes.
• Experience supporting PCI DSS, SOC 2, ISO 27001, or similar frameworks.
• Strong written and verbal communication for security findings to technical and executive audiences.

Responsibilities

• Own and continuously improve the Security Incident Response program (policies, playbooks, classifications).
• Lead incident responses, coordinating investigation, containment, eradication, and recovery.
• Oversee MSSP governance, onboarding, escalation, service reviews, SLAs, and performance metrics.
• Improve alert quality, detection rules, investigation procedures, log coverage, and automation.
• Hold MSSP accountable for contractual performance and remediation tracking.
• Lead tabletop exercises and document lessons learned for program improvements.
• Maintain incident response readiness through coverage, training, and coordination with responders.
• Provide operational reporting on incident trends, metrics, and gaps; support risk and compliance activities.

Skills

Incident response

Security operations

MSSP governance

Cloud security

SIEM

Threat detection

Security frameworks

Security reporting

Executive communication

Tools

Sumo Logic

AWS security tools

Cloudflare

Lacework

Sophos

Job description

iSeatz drives enduring brand loyalty through exceptional, connected experiences. Our digital commerce and technology solutions enable travel and lifestyle bookings for the world’s leading brands in financial services, travel, and hospitality, including American Express, IHG Hotels & Resorts, Qantas, and more.

What We Do

We have a history of long-term trusted relationships and innovation that drives tangible value to our customers through a customizable, scalable, and secure platform, a global third-party marketplace, and loyalty integration. Our proprietary platform processes over $9B per year in transactions.

We aspire to put our customers at the heart of every decision and exceed their expectations with best-in-class solutions and business-value innovations.

What You’ll Do

The Incident Response Program Lead reports to the Information Security Manager and leads the development and operation of iSeatz's security incident response program while overseeing the day-to-day governance of our Managed Security Service Provider (MSSP).

In this hands-on leadership role, you will coordinate responses to security and compliance incidents, oversee vendor governance, strengthen security operations and incident readiness, and serve as a trusted advisor to the Information Security Manager and cross-functional partners.

Your Impact

• Own and continuously improve the Security Incident Response program, including policies, plans, playbooks, severity classifications, escalation criteria, communication protocols, and incident documentation
• Serve as the incident lead during security and compliance incidents, coordinating investigation, containment, eradication, recovery, evidence preservation, and post-incident activities across technical and business teams
• Oversee MSSP governance and performance, including onboarding, service integration, escalation procedures, service reviews, contractual requirements, SLAs, detection coverage, response times, quality standards, and agreed-upon metrics
• Partner with the MSSP and internal teams to improve alert quality, detection rules, investigation procedures, log coverage, threat intelligence, and response automation
• Hold MSSP accountable for contractual and operational performance, running service reviews and track deficiencies and corrective actions to closure.
• Lead incident response tabletop exercises and other required testing activities, documenting lessons learned, corrective actions, and program improvements and tracking remediation through completion
• Maintain incident response readiness through appropriate coverage, escalation capabilities, responder training, and coordination with the MSSP and designated internal responders
• Drive operational reporting on incident trends, response metrics, recurring issues, MSSP performance, control gaps, and areas requiring leadership attention
• Support the Information Security Manager with risk assessments, compliance activities, audit preparation, policy development, control reviews, vendor assessments, and remediation planning
• Advise leadership and technical teams on security events, emerging risks, operational priorities, and recommended actions, translating technical security issues into clear business risks and decisions
• Participate in an incident escalation or on-call rotation as required

What You Bring to the Table

• Five or more years of experience in information security, including substantial experience in incident response, security operations, detection and response, or a related discipline
• Demonstrated experience leading or coordinating security incidents across technical and business teams, with a strong understanding of the full incident response lifecycle
• Experience developing, maintaining, and testing incident response plans, procedures, and playbooks
• Experience working with an MSSP, MDR provider, SOC, or other managed security partner
• Working knowledge of security monitoring, SIEM, endpoint security, cloud security, vulnerability management, identity and access management, and network security, with experience using logs and technical evidence to investigate security events
• Experience with cloud-based environments, particularly AWS, and the security considerations associated with multi-account cloud architectures
• Knowledge of recognized security and incident response frameworks, such as NIST CSF, NIST SP 800-61, and the SANS incident response process
• Experience supporting security or compliance programs such as PCI DSS, SOC 2, ISO 27001, or similar frameworks
• Strong written and verbal communication skills, with the ability to produce clear incident documentation and communicate technical findings, risks, and recommendations to technical responders and business leaders
• Ability to work independently, establish priorities, and make sound decisions while driving initiatives through completion in high-pressure or time-sensitive situations
• Experience leading tabletop exercises involving executive leadership, Legal, Compliance, Engineering, and external service providers

Bonus Points

• Experience with detection engineering and security operations, including detection coverage and tuning, false-positive reduction, threat hunting, digital forensics, malware analysis, or security automation
• Hands-on experience with Sumo Logic, AWS Security tools, Cloudflare, Lacework, Sophos, or similar technologies
• Experience responding to incidents involving payment card data or other regulated or sensitive information
• Familiarity with PCI DSS 4.0.1 standards and payment-brand notification processes
• Experience developing or improving a security operations program within a growing or cloud-native organization
• Experience mentoring security professionals or leading project-based, matrixed, or virtual teams

Pay Range for this Position:

$146,000 - $155,000 USD

Location

This role is remote and can be located anywhere inside the continental United States. iSeatz is a New Orleans-based company with Central Time Zone business hours, but feel free to work from your home office, from the beach, or from the cottage you rented for the summer!

What We Bring To The Table

iSeatz has been honored as an Inc. Magazine Best Workplace for the past three years — recognition based on our commitment to transparency, trust, and open communication, as well as our efforts to foster growth for our team members beyond their current roles and responsibilities.

We trust our team members to use their expertise and creativity to deliver high-quality results — without micromanagement — and support them in building careers that are as dynamic and multifaceted as the work we do.

We believe there's no one-size-fits-all approach to engagement or collaboration. That’s why we strive to provide the tools, autonomy, and support employees need to succeed — while delivering exceptional products and services to our customers.

We recognize that great work deserves meaningful support. At iSeatz, we provide competitive compensation and a comprehensive suite of benefits to match. Our team members enjoy robust health insurance, a 401(k) plan with company matching, generous paid time off, and up to eight weeks of paid parental leave for eligible caregivers. We’re a remote-first company that values flexibility and autonomy, and we invest in continuous learning with an annual professional development allowance. Whether you're growing your skills, your family, or your impact — we’re here to support what’s next.

We Value A Diverse Workplace

We are committed to building and maintaining a culture of support, awareness, and sensitivity about the importance and impact of our differences and leverage these differences to build a stronger iSeatz.

If reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or to receive other benefits and privileges of employment, please contact the People Operations Team at [e-mail] .

A Note About Joining Our Workforce

At iSeatz, we're building a team of bold thinkers, innovative builders, and thoughtful collaborators — people who are excited to make an impact, grow their careers, and help shape the future of travel and loyalty tech.

If you're energized by meaningful work, passionate about creating exceptional experiences, and ready to bring your unique perspective to a team that values trust, growth, and transparency — we can't wait to meet you.