Lead Incident Command – Cyber & OT Operations

EY; Tucson (AZ); On-site; USD 104,800 - 192,200; Full time

Benefits offered by this job

EY professional development

Job summary

EY, a global professional services firm, is seeking a Lead Incident Response Coordinator to serve as the central point of coordination for operational, cybersecurity, infrastructure, connectivity, monitoring, and service-impacting incidents.

The role leads incident command activities, coordinates cross-functional response efforts, manages communications and escalations, tracks resolution actions, and helps ensure timely service restoration while maintaining operational accountability and

Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, Engineering, Business, or equivalent experience preferred.
• 6+ years of experience in incident management, operations coordination, cybersecurity operations, infrastructure operations, service management, or technical delivery roles.
• Experience coordinating incidents, escalations, major operational events, or cross-functional response activities.
• Strong communication, facilitation, documentation, prioritization, and decision-support skills.
• Ability to operate effectively under pressure and maintain structure during high-impact incidents.

Responsibilities

• Incident Command and Coordination: lead incidents and major operational events requiring cross-functional response.
• Escalation Management: evaluate severity, coordinate experts, escalate blockers and risks.
• Communications Management: develop clear incident communications for teams and stakeholders.
• Resolution Tracking and Recovery: maintain logs, track actions, ensure restoration milestones.
• Cross-Team Leadership: coordinate response across monitoring, network, infrastructure, cybersecurity, and vendors.
• Post-Incident and Continuous Improvement: conduct reviews, capture lessons, update playbooks.

Job description

EY, a global professional services firm, is seeking a Lead Incident Response Coordinator to serve as the central point of coordination for operational, cybersecurity, infrastructure, connectivity, monitoring, and service-impacting incidents.

The role leads incident command activities, coordinates cross-functional response efforts, manages communications and escalations, tracks resolution actions, and helps ensure timely service restoration while maintaining operational accountability and