Senior Cybersecurity Incident Coordinator

Cybersecurity Jobs; Warren (MI); Hybrid; USD 120,000 - 190,000; Full time

Benefits offered by this job

Relocation benefits

Hybrid work environment

Job summary

General Motors is seeking a Senior Cybersecurity Incident Response Coordinator in Warren, MI. The role drives end‑to‑end coordination of complex incidents, translating technical findings into business risk decisions and leading communications across the incident lifecycle.

You will partner with Security Operations, incident handlers, application security, vulnerability management, and leadership to ensure timely containment and recovery while maintaining governance and post‑incident improvements.

Qualifications

• Experience coordinating complex cybersecurity incidents or other high‑impact technology events.
• Advanced written and verbal communication skills, including briefing senior leaders.
• Proven ability to make timely, sound decisions under pressure and ambiguity.
• Strong customer service and relationship management across technical and business stakeholders.

Responsibilities

• Lead coordination of complex cybersecurity incidents from triage to containment, eradication, recovery, and post‑incident review.
• Serve as primary coordination point across GM Security Operations, incident handlers, and related teams.
• Apply containment methods balancing business continuity, risk, and recovery needs.
• Collect, validate and document victim, asset, and business‑impact information for risk‑based decisions.
• Maintain incident status, logs, and stakeholder communications throughout the response.
• Communicate actions, risks, findings, and recovery plans to technical and non‑technical audiences including leadership.

Skills

Incident coordination

Executive communication

Risk-based decision making

Leadership

Project management

Collaboration

Analytical thinking

Job description

Hybrid in Warren, MI with the support of a mature cybersecurity incident response organization, this senior role drives end-to-end coordination of complex, high-impact incidents at General Motors. You will establish incident clarity and accountability, translate technical findings into business-relevant risk decisions, and lead clear communication and reporting throughout the full incident lifecycle.

What you will do

• Lead coordination of complex cybersecurity incidents from initial triage through containment, eradication, recovery, and post-incident review.
• Act as the primary coordination point across GM Security Operations, incident handlers, application security, vulnerability management, infrastructure teams, business partners, and leadership.
• Apply approved tactical containment methods for impacted hosts, applications, identities, and other technology assets, balancing business continuity, operational risk, and recovery needs.
• Direct collection, validation, and documentation of victim, asset, application, and business-impact information to enable informed, risk-based decision-making.
• Maintain incident status, action tracking, decision logs, stakeholder communications, and escalation records throughout the response.
• Communicate incident actions, emerging risks, technical findings, root cause analysis, recovery considerations, and residual risk to both technical and non-technical audiences, including senior leadership.
• Identify dependencies, remove response blockers, establish clear ownership, and drive timely execution across multiple teams.
• Ensure response activities follow approved policies, standards, playbooks, service‑level expectations, and governance requirements.
• Track, analyze, and report Security Operations incident metrics, including response performance, containment progress, trends, recurring control gaps, and opportunities for improvement.
• Lead or facilitate post‑incident reviews to identify systemic weaknesses, lessons learned, corrective actions, and resilience improvements.
• Partner with security and technology leaders to improve incident response processes, playbooks, automation, documentation, and operational readiness.
• Coach and mentor incident coordinators and other team members to reinforce consistent decision‑making, communication, and response practices.
• Represent incident response in cross‑functional initiatives such as risk discussions, control assessments, exercises, and continuous improvement efforts.
• Develop and deliver executive‑level communications covering cybersecurity incidents, business impact, and response actions.
• Develop, enhance, and maintain incident response toolsets to streamline operations and improve effectiveness.
• Operate as a subject‑matter leader for cybersecurity incident coordination and response operations.
• Provide concise, actionable reporting that supports enterprise risk decisions and prioritization.
• Support on‑call rotation during off hours and holidays.

What you bring

• Strong analytical and critical‑thinking skills to evaluate incomplete or conflicting information, set priorities, and communicate defensible conclusions.
• Experience coordinating complex cybersecurity incidents (or other high‑impact technology events) across technical and business stakeholders.
• Advanced written and verbal communication skills, including the ability to brief senior leaders and connect technical risk to business implications.
• Proven ability to make timely, sound decisions in high‑pressure, ambiguous, rapidly changing situations.
• Strong customer service and relationship‑management skills with a track record of building trust across technical teams, business partners, and leadership.
• Ability to work effectively in a highly collaborative, globally distributed team environment.
• Experience coaching, mentoring, or developing others and supporting a culture of operational excellence.
• Ability to manage multiple priorities, maintain attention to detail, and drive accountability across the incident lifecycle.
• Commitment to continuous improvement, process discipline, and effective cybersecurity governance.
• Strong project management skills.

Hybrid / Location expectation

This role is categorized as hybrid. The selected candidate is expected to report to a specific location at least 3 times a week (or other frequency dictated by their manager).

Relocation

Relocation benefits are available for candidates who qualify under company policy.

Immigration sponsorship

GM does not provide immigration‑related sponsorship for this role. Do not apply for this role if you will need GM immigration sponsorship now or in the future.