Incident Response Manager

TTEC•Austin, TX

8h•$120,000 - $140,000•Remote

About The Position

As part of TTEC’s Information Security team, the Incident Response Manager will manage the team responsible for detecting, containing, and remediating cybersecurity threats. This role requires a blend of technical understanding of attack methods and response, along with leadership skills to manage experienced security analysts. TTEC is an award-winning company with a strong focus on employee experience, culture, and making a positive impact.

Requirements

5+ years in CyberSecurity including experience with security tools including EDR, SIEM, etc.
3+ years of leadership experience
Strong understanding of advanced threat analysis methodologies like MITRE ATT&CK®
Review runbooks to assist SOC Analysts and other team members with appropriate reactions and activities based on finding types
Capable of self-direction in situations involving complex attack methods that require in-depth analysis and response
Ensure solid communication with key stakeholders, including progress on issues or findings and setting relevant expectations
Familiarity with security assessments and audits covering Protected Health Information (PHI), Personally Identifiable Information (PII), and Payment Card Industry Data Security Standard (PCI DSS)
Experience in preparing security documentation, evaluating and documenting security and privacy controls, and completing non-technical analysis activities

Nice To Haves

Some experience with common penetration tools/frameworks (Open Source or Commercial)
Powershell and/or Python scripting experience and building API-based integrations

Responsibilities

Lead Incident Lifecycle efforts, serving as the responder for security incidents escalated by the 24x7 SOC, including coordination of containment, eradication, and recovery activities across technical teams.
Manage and mentor a high‑performing Incident Response and Security Analyst team, providing hands‑on technical guidance, coaching, and professional development to strengthen detection and response capabilities.
Develop, maintain, and continuously improve the Incident Response Plan (IRP) and detailed playbooks for a range of threat scenarios, including ransomware, phishing, insider threat, and third‑party incidents, ensuring alignment with evolving attack methods and regulatory requirements.
Design and facilitate tabletop and simulation exercises to test incident readiness, validate executive and technical response procedures, and identify gaps prior to real‑world events.
Translate complex technical findings into clear, actionable communications for Legal, HR, executive leadership, and business stakeholders during and after security incidents.
Conduct Post‑Incident Reviews (Post‑Mortems) to assess root cause, response effectiveness, and control gaps, driving continuous improvement of security posture, policies, and processes.
Prepare, validate, and maintain security and compliance documentation.
Advise internal and client teams on remediation of security and privacy weaknesses, balancing risk, compliance, and operational impact.
Prepare and deliver security and privacy awareness training tailored to technical teams, business users, and leadership audiences.