Incident Response Coordinator

Global Payments Inc.•Columbus, GA

19h

About The Position

The Incident Response Coordinator is part of the Global Cybersecurity Incident Management (GCIM) team and coordinates containment, eradication, recovery, and post-incident activities for critical cybersecurity incidents. The role serves on the Incident Response Team, oversees, validates, and documents containment, and acts as an escalation point for the Global Security Operations Center (GSOC). After containment and recovery, the coordinator engages stakeholders in root cause analysis and follow-up work to reduce recurrence and assess the effectiveness of response techniques and procedures. The coordinator supports the corporate security incident response plan, maintains day-to-day runbooks, and provides rotating 24x7 on-call incident-management support for critical incidents. The role works with internal teams, Legal and Privacy offices, Risk Management, and whitehat researchers, and communicates with executives during incidents. It also requires continued awareness of emerging threats, relevant security frameworks and regulations, and opportunities to improve the security posture through assessments and lessons learned.

Requirements

Bachelor’s degree in Computer Science, Information Security, or a related field, or relevant work experience in a related field.
Typically, a minimum of 2 years of relevant experience in incident management or incident response.
Knowledge of network operations or engineering, or system administration on Unix, Linux, MAC (Message Authentication Code), or Windows.
Knowledge of common security operations, intrusion detection systems, Security Incident Event Management systems, penetration testing, web application assessment, secure coding practices, and cloud technologies.
Strong verbal and written communication skills.
Ability to communicate ideas effectively and persuade others to accomplish challenging goals and objectives.
Ability to facilitate meetings and discussions that lead to resolution and communicate results.
Developing professional expertise and ability to apply company policies and procedures to resolve varied issues.
Ability to analyze problems of moderate scope, review a variety of factors, and exercise judgment within defined procedures and practices.
Ability to build productive internal and external working relationships.
Ability to work with general instructions on routine work and detailed instructions on new projects or assignments.
Commitment to continued self-education on emerging threats and relevant processes, controls, and technologies.
Knowledge and skills to contribute to all phases of incident response.
Must be authorized to work in the U.S. without current or future employment-based visa sponsorship.

Nice To Haves

ITIL V4.
Professional security certifications such as CompTIA Security+, CompTIA Cybersecurity Analyst+, SSCP, CISM, CISA, GSEC, or GCIH.
Knowledge of industry-standard security compliance programs, including PCI, GDPR, and the NIST Cyber Security Framework.
Cloud knowledge or certifications such as Google Cloud Fundamental or AWS Foundations.
Experience working in Google Workspace and JIRA.

Responsibilities

Coordinate incident response in accordance with the corporate security incident response plan.
Manage post-incident activities, including scheduling and chairing Post Incident Reviews (PIRs), documenting Root Cause Analysis (RCA), and tracking actions to prevent recurrence.
Provide 24x7 on-call incident management support on a rotation for critical security incidents.
Stay current on emerging threats affecting organizational information assets, third-party software and solutions, IT configuration changes, and networks and systems.
Provide executive-level written communications in response to inquiries about security incidents or assigned cases.
Coordinate remediation of findings from the Bug Bounty Program in direct collaboration with whitehat researchers.
Work with Risk Management teams to document risks and issues identified through post-incident or root cause analysis activities.
Maintain working knowledge of relevant data security frameworks and regulations, including PCI, HIPAA, GDPR, PII, and NIST CSF.
Collaborate with company Legal and Privacy offices on critical data protection and security incidents.
Participate in reviews and assessments and recommend ways to improve the security posture of environments through post-incident activities and lessons learned.
Maintain and follow runbooks for day-to-day incident response in accordance with the corporate security incident response plan.