Remote Incident Commander & IR Leader

Allstate Northern Ireland Limited; United States; On-site; USD 120,000 - 193,725; Full time

Job summary

Allstate is seeking a Senior Incident Handler to lead critical security incidents end-to-end from detection to recovery. You will direct war-room operations, coordinate analysts, and drive rapid decisions in high-stakes environments.

Aligning with executives and partners, you will advance threat investigations, leverage EDR/XDR and cloud telemetry, and push automation and AI to accelerate triage while preserving human judgment.

Qualifications

• 5+ years in cybersecurity operations or incident response, with a track record of leading complex, enterprise-scale incidents end-to-end.
• Financial services or insurance experience is a plus.
• Demonstrated ability to act as incident commander or technical lead in high-stakes moments.

Responsibilities

• Incident Handling & Response Leadership: lead the full lifecycle from detection through containment, eradication, and recovery.
• Cross-Functional Coordination: unify analysts, infrastructure, legal, and partners into a fast-moving response.
• Executive Communication: translate technical realities into business impact for stakeholders up to the C-suite.
• Deep Threat Investigation: lead investigations into malware, identity compromise, ransomware, and targeted attacks.
• AI & Automation Leadership: modernize the SOC with automation and AI-assisted tooling.
• Team Uplevel & Continuous Improvement: improve detections, playbooks, and incident practices.

Skills

Cross-Functional Collaboration

Cyber Incident Response

Cyber Investigations

Cybersecurity Operations

Threat Hunting

Executive Communications

EDR/XDR

Automation & SOAR

Technical Leadership

Scripting/Automation

Job description

Allstate is seeking a Senior Incident Handler to lead critical security incidents end-to-end from detection to recovery. You will direct war-room operations, coordinate analysts, and drive rapid decisions in high-stakes environments.

Aligning with executives and partners, you will advance threat investigations, leverage EDR/XDR and cloud telemetry, and push automation and AI to accelerate triage while preserving human judgment.