Lead Incident Command & Recovery Coordinator

EY; Detroit (MI); Hybrid; USD 105,000 - 192,000; Full time

Benefits offered by this job

Hybrid work model

Competitive compensation

Medical and dental coverage

Pension and 401(k)

Paid time off

Job summary

EY seeks a Lead Incident Response Coordinator to serve as the central point of coordination for operational, cybersecurity, infrastructure, connectivity, monitoring, and service-impacting incidents.

The role leads incident command activities, coordinates cross-functional response efforts, manages communications and escalations, tracks resolution actions, and helps ensure timely service restoration while maintaining operational accountability and stakeholder awareness.

Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, Engineering, Business, or equivalent experience preferred.
• 6+ years of experience in incident management, operations coordination, cybersecurity operations, infrastructure operations, service management, or technical delivery roles.
• Experience coordinating incidents, escalations, major operational events, or cross-functional response activities.
• Strong understanding of operational support models, service restoration practices, escalation processes, and stakeholder communications.
• Ability to coordinate technical teams without directly performing all technical remediation activities.
• Strong communication, facilitation, documentation, prioritization, and decision-support skills.
• Ability to operate effectively under pressure and maintain clear structure during high-impact incidents.

Responsibilities

• Serve as the lead coordinator for incidents and major operational events requiring cross-functional response.
• Establish incident command structure, response rhythm, and clear ownership during active incidents.
• Coordinate response activities across technical, operational, cybersecurity, vendor, and stakeholder teams.
• Assign, confirm, and track incident actions through restoration and closure.
• Ensure response activities remain aligned to incident priority, business impact, and restoration objectives.
• Evaluate incident severity, operational impact, and escalation requirements.
• Coordinate engagement of appropriate technical specialists, support teams, vendors, and leadership stakeholders.
• Escalate unresolved issues, critical blockers, and material operational risks through the appropriate channels.
• Facilitate rapid decision-making when response efforts require prioritization, ownership clarification, or leadership engagement.
• Maintain clear visibility into escalation status, response ownership, and unresolved dependencies.
• Develop and coordinate clear incident communications for response teams, leadership, and impacted stakeholders.
• Maintain stakeholder awareness throughout the incident lifecycle, including status, impact, actions, blockers, and recovery progress.
• Coordinate communication cadence during high-priority incidents and ensure updates are accurate, consistent, and actionable.
• Support business, site, customer, or leadership communications where required.
• Ensure incident communications remain factual, concise, and aligned to approved response practices.
• Maintain incident action logs, decision records, recovery tasks, dependencies, and blockers.
• Drive accountability across participating response teams and ensure assigned actions are tracked to completion.
• Validate restoration criteria, recovery milestones, and transition back to normal operations.
• Coordinate closure activities and ensure incident records accurately reflect the response timeline and outcome.
• Support handoff from active incident response into remediation, problem management, or continuous improvement activities.
• Coordinate incident response across monitoring, network, infrastructure, cybersecurity, endpoint, platform, application, vendor, and site support teams.
• Promote consistent incident handling practices across service domains and operational teams.
• Help remove response friction by clarifying ownership, next actions, decision points, and escalation paths.
• Support operational readiness exercises, incident simulations, and tabletop activities as needed.
• Build familiarity with service dependencies, support models, escalation paths, and response expectations.
• Coordinate post-incident reviews and lessons-learned discussions for significant incidents.
• Identify recurring issues, coordination gaps, communication challenges, and operational improvement opportunities.
• Track remediation commitments, action items, and improvement opportunities through completion.
• Support updates to incident response playbooks, communication templates, escalation matrices, and operational procedures.
• Measure and communicate incident response trends, recurring themes, and response effectiveness improvements.

Skills

Incident command

Service restoration

Stakeholder communications

Action tracking

Escalation management

Executive updates

Response coordination

Cross-domain triage

Status reporting

Major incident practices

Operational dependencies

Post-incident reviews

Decision logs

Support model awareness

Playbook improvement

Education

Bachelor's degree in Information Technology, Cybersecurity, Engineering, Business, or equivalent experience

Job description

EY seeks a Lead Incident Response Coordinator to serve as the central point of coordination for operational, cybersecurity, infrastructure, connectivity, monitoring, and service-impacting incidents.

The role leads incident command activities, coordinates cross-functional response efforts, manages communications and escalations, tracks resolution actions, and helps ensure timely service restoration while maintaining operational accountability and stakeholder awareness.