Incident Response Manager

Huron•Chicago, IL

1d•$168,000 - $228,000

About The Position

The Incident Response Manager is responsible for end-to-end coordination of security and data incidents, driving investigations from initial detection through resolution and closure. The role coordinates stakeholders, tracks action items, maintains incident-response processes, and provides leadership with accurate reporting. Incident scope includes breaches, data loss prevention (DLP) events, privacy incidents, fraud and identity matters, unauthorized access, workforce activity concerns, and data exposure events. Success requires sound judgment under pressure, precise communication, and the ability to align technical and business stakeholders throughout an investigation. The role partners with investigators, forensics resources, IT, DLP, Legal, HR, Global Security, Compliance, and business stakeholders. It also collaborates with DLP, GRC, and BCP functions to integrate incident response with adjacent security and continuity programs, including business continuity and ransomware tabletop exercises. The position supports off-hours incidents as needed. The estimated base salary is $140,000–$190,000. The role is eligible for Huron’s annual incentive compensation program, with an estimated total compensation range of $168,000–$228,000. The position is also eligible for benefit plans that include medical, dental, and vision coverage and other wellness programs.

Requirements

At least 5 years of experience in incident response, security operations, GRC, or a related security coordination role; preferably in a large company or consulting firm.
Demonstrated experience coordinating investigations or incidents involving multiple stakeholders and teams.
Undergraduate degree required; preferably in Information Security, Information Technology, Information Systems, or a related discipline.
Working knowledge of incident response frameworks and practices and security domains including DLP, identity and access, privacy, and fraud.
Excellent written and verbal communication skills, including the ability to communicate clearly and calmly with technical and executive audiences.
Strong organizational skills and ability to track concurrent action items across multiple incidents without losing detail.
Ability to remain composed and effective under pressure and flexibility to support incidents outside standard business hours.

Nice To Haves

Security certifications such as GCIH, GCFA, CISM, CISSP, or similar.
Experience with case management or incident tracking tools such as ServiceNow, Jira, or ADO.
Familiarity with DLP, identity and access management, and privacy or fraud investigation practices.
Experience producing metrics and reports for senior leadership.
Analytical problem-solving skills, including synthesizing incident data to support leadership decision-making.
Experience working across time zones and with distributed, cross-functional teams.

Responsibilities

Coordinate security and data incidents from initial detection through resolution and closure.
Partner with investigators, forensics resources, IT, DLP, Legal, HR, and business stakeholders to advance active investigations.
Coordinate responses to breaches, DLP events, privacy incidents, fraud and identity matters, unauthorized access, workforce activity concerns, and data exposure events.
Support timely triage and severity assessment and ensure appropriate stakeholders are engaged.
Serve as a point of contact for stakeholders across Legal, HR, Global Security, IT, and the business during active incidents.
Prepare and deliver timely status updates and executive-level briefings.
Coordinate cross-functional communication to keep investigators, decision-makers, and affected business units aligned.
Support incidents outside standard business hours as needed.
Own the incident tracking system and ensure action items, remediation steps, and follow-ups are assigned, tracked, and completed.
Maintain and refine incident response playbooks, processes, and procedures.
Produce incident metrics and reporting on open, closed, and trending incidents for leadership.
Support post-incident reviews and lessons-learned sessions and incorporate improvements into processes and playbooks.
Collaborate with DLP, GRC, and BCP functions to integrate incident response with security and continuity programs.
Support the integration of incident response scenarios into business continuity and ransomware tabletop exercises.
Partner with Legal and Compliance to help ensure incidents are handled consistently with regulatory, privacy, and compliance obligations.
Identify and address gaps in incident coordination, escalation paths, and stakeholder communication.