Incident Response Coordinator

Global Payment Holding Company•Atlanta, GA

About The Position

The Incident Response Coordinator is part of the Global Cybersecurity Incident Management (GCIM) team and coordinates containment, eradication, recovery, and post-incident activities for critical cybersecurity incidents. The role serves on the Incident Response Team (IRT), overseeing, validating, and documenting containment and acting as an escalation point for the Global Security Operations Center (GSOC). After containment and recovery, the coordinator engages stakeholders in root cause analysis (RCA) and post-incident work to reduce the risk of recurrence and assess the effectiveness of incident response techniques and procedures. The role also coordinates remediation of Bug Bounty Program findings, works with Risk Management, Legal, and Privacy teams, and contributes recommendations to improve security posture. The position provides rotating 24x7 on-call incident management support for critical security incidents.

Requirements

Bachelor's degree in Computer Science, Information Security, or a related field, or relevant work experience in a related field.
Typically, a minimum of 2 years of relevant experience in Incident Management or Incident Response.
Knowledge of network operations or engineering, or system administration on Unix, Linux, MAC (Message Authentication Code), or Windows.
Knowledge of common security operations, intrusion detection systems, Security Incident Event Management systems, penetration testing, web application assessment, secure coding practices, and cloud technologies.
Strong verbal and written communication skills.
Ability to communicate ideas effectively and persuade others to accomplish challenging goals and objectives.
Ability to facilitate meetings and discussions that lead to resolution and communicate results.
Knowledge and skills to contribute to all phases of Incident Response.
Continued self-education on emerging threats and relevant processes, controls, or technologies to mitigate them.
Ability to apply company policies and procedures to resolve a variety of issues, exercise judgment within defined procedures, and build productive internal and external working relationships.

Nice To Haves

ITIL V4.
Professional security certifications such as CompTIA Security+, Cybersecurity Analyst+, Systems Security Certified Practitioner (SSCP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), GIAC Security Essentials (GSEC), or GIAC Certified Incident Handler (GCIH).
Knowledge of industry-standard security compliance programs such as PCI, GDPR, or the NIST Cyber Security Framework.
Cloud knowledge or certifications such as Google Cloud Fundamentals or AWS Foundations.
Experience working in Google Workspace and JIRA.

Responsibilities

Coordinate incident response in accordance with the corporate security incident response plan.
Manage post-incident activities, including scheduling and chairing Post Incident Reviews (PIRs), documenting Root Cause Analysis, and tracking actions to prevent recurrence.
Provide rotating 24x7 on-call incident management support for critical security incidents.
Stay current on emerging threats affecting the organization's information assets, third-party software and solutions, IT configuration changes, networks, and systems.
Provide executive-level written communications in response to inquiries about security incidents or assigned cases.
Coordinate remediation of Bug Bounty Program findings while working directly with whitehat researchers.
Work with Risk Management teams to document risks and issues identified through post-incident or root cause analysis activities.
Collaborate with Legal and Privacy Offices on critical data protection and security incidents.
Participate in reviews and assessments and recommend ways to improve security posture through post-incident activities and lessons learned.
Maintain and follow runbooks for day-to-day incident response in accordance with the corporate security incident response plan.