Strategic CSOC Incident Response Lead

The Sherwin-Williams Company; Cleveland (OH); On-site; USD 120,000 - 170,000; Full time

Job summary

The Sherwin-Williams Company is seeking a Cybersecurity CSOC Incident Response Lead to oversee and coordinate security incidents, acting as primary decision-maker during breaches and guiding the IR team to minimize risk and restore operations quickly.

The role demands leadership, strong technical knowledge of network security and incident response, and hands-on use of SIEM/SOAR tools with collaboration across IT, OT, and executive stakeholders.

Qualifications

• Bachelor's degree in computer science, Information Technology, or related field (or equivalent experience).
• 8+ years IT/Cybersecurity experience.
• Proven experience leading and coordinating IR efforts in a fast-paced environment.
• Strong technical knowledge of network security, malware analysis, intrusion detection, and related technologies.
• Excellent communication and interpersonal skills with stakeholders at all levels.
• Ability to remain calm under pressure and deliver results.

Responsibilities

• Serve as the primary point of contact and decision-maker during cybersecurity incidents.
• Lead and coordinate incident response efforts within the IR team, mobilizing resources and implementing response plans.
• Collaborate with internal and external stakeholders to assess impact and prioritize actions.
• Provide clear updates to executive leadership throughout the incident lifecycle.
• Develop and refine incident response playbooks and post-incident reviews.

Skills

Incident response

Leadership

Stakeholder communication

Threat intelligence

Education

Bachelor's degree in computer science, Information Technology, or related field

8+ years IT/Cybersecurity experience

Tools

SIEM/SOAR

Splunk

Sumo Logic

Job description

The Sherwin-Williams Company is seeking a Cybersecurity CSOC Incident Response Lead to oversee and coordinate security incidents, acting as primary decision-maker during breaches and guiding the IR team to minimize risk and restore operations quickly.

The role demands leadership, strong technical knowledge of network security and incident response, and hands-on use of SIEM/SOAR tools with collaboration across IT, OT, and executive stakeholders.