Senior Cyber Incident Response Lead (Remote)

KeyBank; United States; Hybrid; USD 96,000 - 181,000; Full time

Job summary

KeyBank is seeking an experienced Cyber Incident Response Lead to join the Cyber Defense team. You will own the incident response program, coordinate with Cyber Defense, technology, business, risk, legal, communications, and executives, and drive continuous improvement in playbooks and runbooks.

The role requires strong incident response leadership, executive communication, and the ability to translate complex cyber events into actionable business outcomes, regulatory alignment, and enterprise

Qualifications

• Required: Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Business Continuity, Risk Management, or related field - or equivalent practical experience.
• Required: 8+ years of experience in cybersecurity, incident response, security operations, cyber risk management, technology incident management, or related disciplines.
• Demonstrated experience leading or coordinating cybersecurity incidents in complex enterprise environments.
• Strong understanding of incident response lifecycle activities, including preparation, detection, analysis, containment, eradication, recovery, and post-incident improvement.
• Experience developing or maintaining incident response plans, playbooks, runbooks, procedures, executive summaries, or after-action reports.
• Ability to lead cross-functional teams during high-pressure situations and drive clarity, accountability, and timely decision-making.
• Strong executive communication skills, including the ability to translate technical cyber incidents into business impact, risk, actions taken, and next steps.
• Experience planning, facilitating, or participating in tabletop exercises, cyber simulations, or crisis response exercises.

Responsibilities

• Incident Leadership: Lead cybersecurity incident response coordination for significant cyber events, ensuring appropriate triage, escalation, containment coordination, stakeholder engagement, and resolution tracking.
• Incident Command & Coordination: Serve as a primary Cyber Defense incident response lead during active incidents, coordinating across multiple enterprise partners.
• Documentation & Case Management: Ensure accurate, timely, and complete documentation of incident timelines, actions taken, decisions made, evidence collected, communications issued, and lessons learned.
• Program Development: Develop, mature, and maintain the Cyber Defense incident response program, including response frameworks, operating models, escalation paths, governance routines, templates, metrics, and continuous improvement processes.
• Playbook & Runbook Management: Create, update, and maintain incident response playbooks, runbooks, quick reference guides, and standard operating procedures to support consistent execution during cyber events.
• Tabletop Exercises: Design, facilitate, and evaluate cyber tabletop exercises, simulations, and scenario-based discussions to test readiness, validate response plans, identify gaps, and drive remediation actions.
• Post-Incident Reviews: Lead post-incident reviews and lessons-learned sessions, documenting root cause, response effectiveness, improvement opportunities, and ownership of follow-up actions.
• Executive Reporting: Develop clear, concise, and business-relevant incident reporting for Cyber Defense leadership, CIS leadership, executive stakeholders, committees, and board-level audiences as appropriate.

Skills

Incident leadership

Executive communication

Tabletop exercises

Crisis management

Cross-functional collaboration

Documentation

Education

Bachelor's degree in Cybersecurity or related field

Tools

SIEM

EDR/XDR

SOAR

Threat intelligence platforms

Vulnerability management

Cloud security

Job description

KeyBank is seeking an experienced Cyber Incident Response Lead to join the Cyber Defense team. You will own the incident response program, coordinate with Cyber Defense, technology, business, risk, legal, communications, and executives, and drive continuous improvement in playbooks and runbooks.

The role requires strong incident response leadership, executive communication, and the ability to translate complex cyber events into actionable business outcomes, regulatory alignment, and enterprise