Sr Manager, Security Incident Response

Lowe's; Florida; On-site; USD 150,000 - 190,000; Full time

Job summary

Lowe's is seeking a Sr Manager, Security Incident Response in the United States to lead end-to-end cybersecurity incident management across the enterprise. You will coordinate Security Operations, Incident Response, Forensics, Threat Intelligence, Infrastructure, Cloud, Network, and business stakeholders.

You will serve as Incident Commander for high-severity incidents, drive rapid, coordinated responses, and translate findings for executives while working with Legal, Privacy and Communications

Qualifications

• Bachelor's degree or equivalent years of experience in cybersecurity, IT, or related field.
• 8 years IT experience with broad exposure to business/system planning, analysis, and application development.
• 3 years experience leading project or technical teams with/without direct reports.
• 4 years experience with information security tools, concepts and practices.
• Experience managing projects and resources across multiple concurrent projects.

Responsibilities

• Lead the cybersecurity incident lifecycle from identification through containment, eradication, recovery, closure, and post-incident review.
• Act as Incident Commander for high-severity incidents; set severity, impact, escalation, and priorities.
• Coordinate SOC, Incident Response, Digital Forensics, Threat Intelligence, andInfrastructure teams.
• Lead incident bridges and war rooms with clear ownership, action tracking, and escalation paths.
• Translate technical findings into clear business and risk language for executives with timely situation reporting.
• Partner with Legal, Privacy, Compliance, Communications, HR, and leadership when incidents have regulatory or reputational implications.
• Ensure evidence preservation and proper forensic processes during investigations.
• Drive root-cause analysis and post-incident reviews with actionable lessons learned.

Skills

SIEM/SOAR

EDR/XDR

Network security

Cloud security

Identity and access management

Threat intelligence

Forensic investigation

Security operations

Education

Bachelor's degree in Computer Science, CIS, Engineering, Business Administration, Cybersecurity, or related field

Tools

Digital Forensics Tools

Incident management tools

Job description

Innovate in Charlotte

Your Impact

The Sr Manager, Security Incident Response leads and coordinates the end-to-end management of cybersecurity incidents across the enterprise. The role serves as the central point of coordination during significant security events, bringing together Security Operations, Incident Response, Forensics, Threat Intelligence, Infrastructure, Cloud, Network, Application, Identity, Legal, Privacy, Communications, and business stakeholders.

The Sr Manager, Security Incident Response ensures that when a cybersecurity event occurs, the organization responds quickly, consistently, and decisively; minimizes business disruption and security exposure; maintains effective executive visibility; and converts lessons from incidents into measurable improvements in enterprise cyber resilience.

What You Will Do

• Lead the cybersecurity incident lifecycle from identification and triage through containment, eradication, recovery, closure, and post-incident review.
• Act as Incident Commander for high-severity and enterprise-impacting cybersecurity incidents; establish severity, business impact, escalation requirements, and response priorities.
• Coordinate SOC, Incident Response, Digital Forensics, Threat Intelligence, Offensive Security, Vulnerability. Management, Identity, Cloud, Network, Endpoint, Application Security, and infrastructure teams.
• Lead incident bridges and war rooms while maintaining clear ownership, action tracking, decision logs, timelines, and escalation paths.
• Translate complex technical findings into clear business and risk language for senior executives and provide timely executive-level situation reporting.
• Partner with Legal, Privacy, Compliance, Corporate Communications, HR, and business leadership when incidents have regulatory, privacy, employee, customer, or reputational implications.
• Ensure appropriate evidence preservation and forensic processes are followed throughout investigations.
• Drive root-cause analysis and post-incident reviews; track corrective actions and lessons learned through completion.
• Identify recurring incident patterns and recommend improvements to detection, response automation, security controls, processes, and technology.
• Develop and maintain incident response playbooks, escalation matrices, communication protocols, and crisis management procedures.
• Improved incident response maturity, preparedness, and collaboration across Security, Technology, and business organizations.
• Conduct tabletop exercises and cyber simulations covering ransomware, data breaches, compromised credentials, cloud incidents, insider threats, and supply-chain attacks.
• Define and track operational metrics such as MTTD, MTTA, MTTC, MTTR, incident volume, severity trends, recurrence rates, and response effectiveness.

Leadership

The position requires strong technical understanding combined with exceptional incident leadership, communication, decision-making, and executive stakeholder management capabilities.

Remains composed during critical incidents and establishes clarity when information is incomplete or rapidly changing.

Influences teams without direct authority and creates alignment across technical, business, and executive stakeholders.

Demonstrates ownership, accountability, collaboration, resilience, empathy, sound judgment, and executive presence.

Adapts communication for technical responders, business leaders, and C-suite executives while maintaining a consistent view of incident risk and status.

Minimum Qualifications

• Bachelor's degree Computer Science, CIS, Engineering, Business Administration, Cybersecurity, or related field or equivalent years of experience in lieu of education requirement, if applicable.
• 8 years IT experience with a broad range of exposure to all aspects of business/system planning, analysis, and application development.
• 3 years experience leading project or technical teams with or without formal direct report responsibility; this includes experience providing technical direction, thought leadership, coaching and mentoring to team members.
• 4 years experience with information security tools, concepts and practices.
• Experience managing projects and project resources to meet goals on simultaneous/multiple projects.

Preferred Skills/Education

• 10+ years of cybersecurity or IT experience, with significant experience in Security Operations, Incident Response, Cyber Defense, Digital Forensics, or related disciplines.
• Demonstrated experience managing major security incidents in complex enterprise environments.
• Strong knowledge of SIEM/SOAR, EDR/XDR, network security, cloud security, identity and access management, threat intelligence, ransomware response, vulnerability management, and forensic investigation.
• Strong leadership under pressure, structured problem-sol