Cyber Security Incident Response - IR Manager

WTW•Atlanta, GA

18h

About The Position

The Cyber Security Incident Response IR Manager is part of WTW’s Global Information and Cyber Security Defence function and Cyber Security Incident Response Team. The role leads responses to complex security incidents and develops WTW’s incident management capabilities, procedures, playbooks, and workflows. It works closely with technical Cyber Defense teams—including SOC, Threat Hunting, Cyber Threat Intelligence, Insider Threat, and Vulnerability Management—as well as business stakeholders such as senior leadership, HR, Legal, and Compliance. The position leads investigations and response activities across hybrid cloud environments, including Azure, AWS, and GCP, and coordinates global teams, forensic investigations, and external partners such as MSSPs. It also supports regulatory compliance, incident reporting, post-incident improvement, team preparedness, mentoring, response automation, and performance measurement. Occasional global travel may be required. The role requires at least seven years of incident response experience and strong technical expertise in forensics, malware and network traffic analysis, SIEM, EDR, and threat intelligence. The stated annual base salary range is $120,000–$180,000, with eligibility for an annual short-term incentive bonus. WTW offers health and welfare benefits, leave benefits, and retirement benefits, subject to eligibility requirements. Employment-based non-immigrant visa sponsorship or assistance is not offered for this opportunity.

Requirements

Minimum seven years of experience in incident response.
Strong understanding of cybersecurity principles, frameworks, and tools.
Proficiency in forensic analysis, malware analysis, and network traffic analysis.
Experience with SIEM tools, EDR platforms, and threat intelligence integration.
Demonstrated ability to lead high-stakes security incidents and coordinate cross-functional teams.
Deep understanding of MITRE ATT&CK, the cyber kill chain, and incident response methodologies.
Exceptional verbal and written communication skills, including the ability to explain complex technical concepts to non-technical audiences and executives.
Proactive and decisive approach, with the ability to work under pressure.
Strong analytical and problem-solving skills.
Collaborative and adaptable, with an interest in mentoring and developing team members.

Nice To Haves

Industry certifications such as CISSP, GCIH, GCFA, or CISM.
Experience with Sentinel, Splunk, Carbon Black, or similar technologies.

Responsibilities

Lead significant security incidents, coordinating technical and business response efforts to minimize impact and support timely resolution.
Lead cloud security incident response across Azure, AWS, GCP, and hybrid environments, including containment, remediation, forensic investigations, and response workflows.
Establish, refine, and maintain incident response processes, playbooks, and workflows.
Serve as the central point of contact for incident response and communicate with internal and external stakeholders, including senior leadership, Legal, HR, and Compliance.
Lead technical investigations escalated from the SOC through containment, eradication, and recovery; identify root causes and potential impact.
Coordinate incident response and information sharing with SOC, Threat Hunting, CTI, Insider Threat, and Vulnerability Management teams.
Conduct root cause analysis and post-incident reviews, implement lessons learned, and improve the incident response program.
Mentor junior analysts and conduct tabletop exercises to improve preparedness.
Monitor emerging threats, attack trends, and threat actor tactics, techniques, and procedures.
Ensure incident handling complies with relevant regulations and prepare detailed regulatory or internal reports.
Evaluate and prioritize incidents by impact and severity, escalating when appropriate.
Assist with developing and refining automation scripts and workflows to improve detection and response efficiency.
Contribute to incident response KPIs and metrics.
Maintain incident records in incident management systems in accordance with internal policies and audit requirements.
Collaborate with MSSPs and integrate SIEM/SOAR platforms to mitigate cloud-native and supply chain attacks.

Benefits

Annual short-term incentive bonus eligibility.
Medical coverage, including prescription drug coverage and fertility benefits.
Dental insurance.
Vision insurance.
Health Savings Account.
Commuter Accounts.
Health Care and Dependent Care Flexible Spending Accounts.
Company-paid life insurance and supplemental life insurance.
Accidental death and dismemberment coverage, group accident coverage, and group critical illness coverage.
Group legal benefits and identity theft protection.
Wellbeing program and mental health/emotional wellbeing resources, including an Employee Assistance Program.
Adoption assistance and surrogacy assistance.
Auto and home insurance and pet insurance.
Work/life resources.
Paid holidays and annual paid time off, including state/local paid leave where required.
Company-paid short-term and long-term disability.
Other leave benefits, including bereavement, FMLA, ADA, jury duty, military, parental, and adoption leave.
Qualified contributory pension plan, if eligible.
401(k) plan with annual nonelective company contribution.
Non-qualified retirement plans for eligible senior-level colleagues.
Paid Time Off for Washington roles only.