Corporate Vice President - Cyber Security Incident Response Team Lead

New York Life•New York, NY

54d•$185,000 - $264,500•Hybrid

About The Position

The Cyber Incident Response (IR) Lead reports directly to the Chief Information Security Officer within the Cybersecurity organization and is accountable for New York Life's enterprise cyber incident response capability. The role establishes unified ownership from cyber incident activation through containment, eradication, secure recovery, and post-incident improvement, integrating specialized technical response with business, executive, legal, regulatory, and external coordination. This position is both the senior incident commander and the people leader for the IR function. The IR Lead directs response the enterprise response to cybersecurity incidents of all severities, makes or drives time-critical response decisions, and ensures clear accountability across technical responders and business coordinators. The role is accountable for regulatory notification readiness, executive incident reporting, and coordination with legal, privacy, compliance, fraud, human resources, corporate communications, and business unit leadership. The individual will lead through ambiguity and operational pressure, exercising authority and composure during active incidents while maintaining the documentation discipline, evidentiary rigor, regulatory readiness, and stakeholder trust required in a regulated financial services environment.

Requirements

Proven leadership of a cybersecurity incident response, digital forensics, security operations, or incident management capability, including direct people leadership.
Demonstrated experience serving as Incident Commander or senior response lead for high-severity, cross-functional cybersecurity incidents in a large enterprise.
Demonstrated technical depth in cybersecurity incident response sufficient to direct and challenge complex investigations, evaluate attacker activity and scope, assess containment and eradication options, and guide responders across endpoint, identity, cloud, network, applications, and enterprise technology environments.
Working command of NIST SP 800-61 and the NIST Cybersecurity Framework, with experience operationalizing incident response standards, playbooks, severity models, exercises, and post-incident improvement.
Experience coordinating across Security Operations, Threat Intelligence, digital forensics, identity and access management, cloud, network, endpoint, infrastructure, applications, business teams, vendors, legal, risk, privacy, compliance, and executive stakeholders.
Experience with regulatory and breach-notification requirements applicable to financial services, insurance, or another highly regulated environment.
Experience preparing executive-facing incident communications, metrics, dashboards, decision materials, and management reporting.
Experience managing external IR/forensics retainers, vendors, statements of work, deliverables, and surge support.
Experience managing cross-functional initiatives involving technology, cybersecurity, risk, legal, business, vendor, and executive stakeholders.
Bachelor's degree required or equivalent work experience.
Eight or more years of cyber security or technology experience, including four or more years in incident response or incident management, and prior team leadership experience.
Working knowledge of the NIST incident response lifecycle, the NIST Cybersecurity Framework, and common adversary frameworks such as MITRE ATT&CK.
High-level understanding of cyber defense organizations, including security operations, incident response, threat intelligence, vulnerability management, identity, infrastructure, and application security functions.
High-level understanding of enterprise technology functions, including application ownership, infrastructure, cloud, networking, end-user technology, and technology operations.
Working knowledge of risk management, issue management, control remediation, and executive reporting practices.
Ability to communicate clearly and professionally with technical teams, business partners, risk stakeholders, vendors, and executive audiences.
Demonstrated ability to assert authority, make decisions with incomplete information, maintain composure, and control the message during active incidents.
Demonstrated ability to build trust and maintain positive working relationships, including in situations involving challenging findings, sensitive topics, or competing priorities.
Strong organizational, analytical, written communication, and presentation skills.
Ability to translate technical or complex cybersecurity concepts into practical business language.
Proven ability to drive accountability and outcomes across teams without direct authority.
Sound judgment, discretion, and professionalism when handling confidential or sensitive information.
Self-motivated and detail-oriented, with the ability to manage shifting priorities in a dynamic execution environment.
Ability to prioritize and deprioritize work based on risk, urgency, stakeholder impact, and

Nice To Haves

Prior experience in a regulated financial services, insurance, or similarly complex enterprise environment preferred.
Experience with incident management platforms, case management tooling, and security orchestration and automation preferred.
Cyber security certification preferred, such as GCIH, GCFA, GCFE, CISSP, CISM, CRISC, or similar designation.

Responsibilities

Act as the enterprise Incident Commander for cybersecurity incidents, with end-to-end accountability from activation through recovery.
Own incident declaration, severity classification, escalation, command structure, decision logging, executive checkpoints, and transition to post-incident activity.
Direct cross-functional response across Security Operations, Threat Intelligence, digital forensics, identity, cloud, network, endpoint, infrastructure, applications, business teams, and external specialists.
Lead containment, eradication, and secure recovery strategy in partnership with technology owners, balancing business impact, operational risk, evidence preservation, and adversary presence.
Oversee evidence handling, chain of custody, and investigative documentation to a standard that supports legal, regulatory, and law enforcement requirements.
Serve as the senior escalation point for cyber incident response with clear decision rights between SOC and IR as events move from alert investigation to confirmed incident response.
Build, develop, and lead a dedicated Cyber Incident Response function accountable to the CISO, combining specialized technical response capabilities with business and operational coordination and establishing clear end-to-end ownership from incident activation through secure recovery.
Establish the IR capability roadmap, operating priorities, talent strategy, readiness objectives, and measurable outcomes; provide the CISO with a clear view of response readiness, material gaps, investment needs, and improvement priorities.
Lead a multidisciplinary team expected to include technical responders focused on detection and containment, systems recovery and IR readiness, specialist response across cloud/identity/network, and business coordinators focused on stakeholder communications and operational continuity.
Set and enforce clear expectations for response quality, documentation standards, communication cadence, and stakeholder handling.
Balance team capacity across active incidents, investigations, program work, audit support, and regulatory deliverables.
Serve as the senior escalation point and incident commander for the most complex, sensitive, or high-impact events.
Maintain on-call rotations, escalation trees, and coverage models that provide continuous incident response availability across business and after hours.
Own the cybersecurity incident management standard, response plan, playbooks, runbooks, and supporting procedures, including annual review, revision, and approval.
Maintain alignment between the incident response program and NIST SP 800-61, the NIST Cybersecurity Framework, and applicable regulatory requirements.
Enhance and maintain the severity taxonomy, incident categorization model, service level expectations, and quality standards for incident records.
Ensure incident tickets, timelines, and case files are complete, accurate, defensible, and audit-ready.
Support internal audit, external audit, regulatory examination, and third-party assessment activities related to incident response.
Partner with the Office of the General Counsel, privacy, and compliance functions to assess notification obligations and support timely, accurate regulatory filings.
Maintain working knowledge of financial services and insurance cybersecurity regulations, including state cybersecurity regulations with defined notification windows, state breach notification statutes, and applicable federal requirements.
Track notification triggers, deadlines, and evidentiary requirements throughout the incident lifecycle, and escalate where determinations are time-critical.
Coordinate third-party and vendor incident response, including service provider notification obligations, contractual security requirements, and supply chain events.
Support legal hold, electronic discovery, and litigation readiness activities arising from cyber incidents.
Serve as the primary point of coordination between security operations, threat intelligence, technology owners, business stakeholders, control functions, and executive audiences during incidents.
Prepare and deliver incident briefings to cybersecurity leadership, technology leadership, risk partners, and senior executives.
Partner with corporate communications on internal and external messaging for incidents carrying reputational, customer, or media exposure.
Coordinate with business continuity, disaster recovery, and crisis management functions when incidents require enterprise-level activation.
Exercise extreme discretion and sound judgment when handling confidential investigations, sensitive findings, and need-to-know communications.
Develop and maintain incident reporting, dashboards, and executive-level materials summarizing incident volume, severity, themes, response performance, and remediation status.
Define and track program metrics, including time to detect, time to contain, time to close, escalation accuracy, and recurrence rates.
Translate complex technical incident detail into clear, practical, audience-appropriate communications.
Identify recurring control gaps and organizational themes surfaced through incidents, and route them into remediation, issue management, and control improvement channels.
Support recurring reporting to cybersecurity leadership, risk committees, senior management, and, as required, board-level audiences.
Ensure reporting is accurate, balanced, actionable, and appropriately sensitive to audience and confidentiality considerations.