Incident Response Manager

Huron Consulting Services•Chicago, IL

11d

About The Position

The Incident Response Manager is responsible for end-to-end coordination of security and data incidents, driving investigations, engaging and informing stakeholders, tracking action items through closure, and maintaining the incident response process and reporting used by leadership. The role covers breaches, data loss prevention (DLP) events, privacy incidents, fraud and identity matters, unauthorized access, workforce activity concerns, and data exposure events. It requires sound judgment under pressure, precise communication, and the ability to align technical and business stakeholders throughout an investigation. The role collaborates with investigators, forensics resources, IT, DLP, Legal, HR, Global Security, Compliance, and business stakeholders. It maintains incident tracking, response playbooks, procedures, metrics, and reporting; supports post-incident reviews; and helps integrate incident response with DLP, GRC, business continuity, and ransomware tabletop exercises. The position may require supporting incidents outside standard business hours. The estimated base salary is $140,000–$190,000. The position is also eligible for Huron’s annual incentive compensation program, with an estimated total compensation range of $168,000–$228,000. It is eligible to participate in Huron benefit plans, including medical, dental, and vision coverage and other wellness programs.

Requirements

At least 5 years of experience in incident response, security operations, GRC, or a related security coordination role; preferably in a large company or consulting firm.
Demonstrated experience coordinating investigations or incidents involving multiple stakeholders and teams.
Undergraduate degree required, preferably in Information Security, Information Technology, Information Systems, or a related discipline.
Working knowledge of incident response frameworks and practices and of security domains that commonly generate incidents, including DLP, identity and access, privacy, and fraud.
Excellent written and verbal communication skills, including the ability to brief technical and executive audiences clearly and calmly.
Strong organizational skills and ability to track many concurrent action items across multiple open incidents without losing detail.
Ability to remain composed and effective under pressure, including flexibility to support incidents outside standard business hours.

Nice To Haves

Security certifications such as GCIH, GCFA, CISM, CISSP, or similar.
Experience with case management or incident tracking tools such as ServiceNow, Jira, or ADO.
Familiarity with DLP, identity and access management, and privacy or fraud investigation practices.
Experience producing metrics and reporting for senior leadership audiences.
Analytical problem-solving skills, including synthesizing incident data to support leadership decision-making.
Experience working across time zones and with distributed, cross-functional teams.

Responsibilities

Coordinate security and data incidents from initial detection through investigation, resolution, and closure.
Partner with investigators, forensics resources, IT, DLP, Legal, HR, and business stakeholders to keep incidents moving and remove obstacles.
Coordinate response to breaches, DLP events, privacy incidents, fraud and identity matters, unauthorized access, workforce activity concerns, and data exposure events.
Support timely triage and severity assessment and ensure appropriate stakeholders are engaged.
Serve as a trusted point of contact for stakeholders across Legal, HR, Global Security, IT, and the business during active incidents.
Prepare and deliver clear, timely status updates and executive-level briefings for leadership.
Coordinate cross-functional communications to keep investigators, decision-makers, and affected business units aligned and avoid conflicting messaging.
Provide flexibility to support time-sensitive incidents outside standard business hours as needed.
Own the incident tracking system and ensure action items, remediation steps, and follow-ups are assigned, tracked, and driven to closure.
Maintain and continuously improve incident response playbooks, processes, and procedures.
Produce incident metrics and reporting that provide leadership with an accurate executive-level view of open, closed, and trending incidents.
Support post-incident reviews and lessons-learned sessions and incorporate improvements into processes and playbooks.
Collaborate with DLP, GRC, and BCP functions to integrate incident response with adjacent security and continuity programs.
Support integration of incident response scenarios into business continuity and ransomware tabletop exercises.
Partner with Legal and Compliance to help ensure incidents are handled consistently with regulatory, privacy, and compliance obligations.
Identify and close gaps in incident response coordination, escalation paths, and stakeholder communication.