Remote Cyber Incident Response Lead

KeyBank; New York (NY); Hybrid; USD 96,000 - 181,000; Full time

Benefits offered by this job

Benefits overview

Job summary

KeyBank is seeking an experienced Cyber Incident Response Lead to drive the enterprise incident response program. You will lead high-impact responses, coordinate across Cyber Defense, technology, business, risk, legal, and executive teams, and continually mature playbooks and runbooks for faster, clearer actions.

You will design tabletop exercises, guide post-incident reviews, and deliver executive-level reporting to CIS leadership.

Qualifications

• Bachelor's degree in cybersecurity, computer science, information technology, business continuity, risk management, or related field, or equivalent experience.
• 8+ years of experience in cybersecurity, incident response, security operations, or related disciplines.
• Proven experience leading or coordinating cybersecurity incidents in complex enterprise environments.
• Knowledge of incident response lifecycle: preparation, detection, analysis, containment, eradication, recovery, post-incident improvement.
• Experience developing or maintaining incident response plans, playbooks, and executive summaries.
• Ability to lead cross-functional teams during high-pressure incidents and drive timely decisions.
• Strong executive communication skills to translate incidents into business impact and actions.
• Experience facilitating tabletop exercises, simulations, or crisis response activities.
• Familiarity with security ops, SIEM, EDR/XDR, SOAR, threat intel, vulnerability management, cloud security, identity security.
• Working knowledge of NIST CSF, MITRE ATT&CK, and related standards.

Responsibilities

• Incident Leadership: Lead incident response coordination for significant cyber events with triage, escalation, containment, and resolution tracking.
• Incident Command & Coordination: Act as primary lead during active incidents across multiple Cyber Defense teams and enterprise partners.
• Documentation & Case Management: Ensure complete, timely documentation of timelines, actions, evidence, and lessons learned.
• Program Development: Develop and maintain the incident response program, models, governance, templates, and metrics.
• Playbook & Runbook Management: Create and update playbooks, runbooks, and SOPs for consistent execution.
• Tabletop Exercises: Design and run tabletop exercises and simulations to test readiness and identify gaps.
• Post-Incident Reviews: Lead reviews, document root cause, improvements, and follow-up ownership.
• Executive Reporting: Produce clear incident reports for CIS leadership and executive audiences.
• Metrics & Continuous Improvement: Track timelines, documentation quality, action closure, and maturity indicators.
• Stakeholder Engagement: Collaborate with business, technology, risk, legal, compliance, and communications.
• Regulatory & Audit Support: Support audits and regulatory requests related to incident response.
• Threat-Informed Readiness: Align plans with threat intel and threat landscapes.
• Crisis Communication Support: Assist leadership with updates, summaries, and situation reports.
• Process Automation & AI Enablement: Identify opportunities for automation and AI-enabled workflows.
• Knowledge Sharing: Provide training and knowledge transfer on incident response practices.

Skills

Incident response

Executive communication

Tabletop exercises

Cross-functional leadership

Documentation

Program management

Stakeholder engagement

Threat awareness

Regulatory alignment

Process improvement

Education

Bachelor's degree in Cybersecurity/CS/IT/Related field

Tools

ServiceNow Security Incident Response

SIEM

EDR/XDR

SOAR

Palo Alto Cortex XSIAM/XSOAR

Job description

KeyBank is seeking an experienced Cyber Incident Response Lead to drive the enterprise incident response program. You will lead high-impact responses, coordinate across Cyber Defense, technology, business, risk, legal, and executive teams, and continually mature playbooks and runbooks for faster, clearer actions.

You will design tabletop exercises, guide post-incident reviews, and deliver executive-level reporting to CIS leadership.