Cyber Security Incident Response Team Lead (CSIRT Manager)

Stellantis•Auburn Hills, MI

About The Position

The CSIRT Manager leads the Cyber Security Incident Response Team (CSIRT), operating within Stellantis’ Cyber Defense Operations Center (CDOC) and in close partnership with several others cybersecurity teams, and regional stakeholders. You will own the incident response lifecycle, ensure adherence to Stellantis crisis procedures, drive operational excellence (MTTD/MTTR), and cultivate a high performing team in a follow the sun model. Stellantis is a global mobility leader with the ambition to deliver clean, safe, and affordable freedom of mobility for all, guided by the Dare Forward 2030 strategy and a commitment to carbon net zero by 2038 (Scopes 1–3) with interim 2030 decarbonization targets. Our portfolio of iconic brands and strong operational performance underpin this transformation into a sustainable mobility tech company.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, or related field.
5+ years in SOC / Cyber Security Incident Response roles with 2+ years managing cyber security incident response teams or programs in large, distributed enterprises.
Demonstrated leadership during high/critical incidents and familiarity with crisis management communications per established escalation matrices.
Hands on knowledge of SIEM/SOAR, EDR, network security monitoring, IA detection & Response tools/ framework and cloud/identity telemetry; strong grasp of attacker TTPs and enterprise hardening.
Experience operating to structured IR frameworks (e.g., NIST style lifecycle) and running formal after action/lessons learned cycles integrated with use case/playbook updates.
Excellent written/oral communication, stakeholder management, and executive reporting skills; comfortable presenting in MBRs and steering forums.

Nice To Haves

Prior leadership within a CSIRT/CSOC supporting multiple regions and product/OT security stakeholders.
Certifications : GCIH, GCFA/GNFA, GCIA, CISSP, OSCP(or comparable).
Experience with threat‑informed defense (MITRE ATT&CK), KPI/SLA governance, and MSSP/retainer management.
Familiarity with worldwide privacy/security obligations and incident communication expectations in regulated, multi‑jurisdictional environments (in partnership with Legal/Privacy).