Incident Response Program Lead

iSeatz

1d•$146,000 - $155,000•Remote

About The Position

The Incident Response Program Lead reports to the Information Security Manager and leads the development and operation of iSeatz’s security incident response program while overseeing day-to-day governance of its Managed Security Service Provider (MSSP). This hands-on leadership role coordinates security and compliance incident response, strengthens security operations and incident readiness, and advises the Information Security Manager and cross-functional partners. The position owns continuous improvement of incident response plans, policies, playbooks, escalation procedures, communications, and documentation. It serves as the incident lead during investigations, coordinating containment, eradication, recovery, evidence preservation, and post-incident activities across technical and business teams. The role also governs MSSP performance, improves alerting and detection practices with internal teams and the provider, leads exercises and operational reporting, and supports risk, compliance, audit, vendor-assessment, and remediation work. The role is remote and may be based anywhere in the continental United States. iSeatz is New Orleans-based and observes Central Time Zone business hours. Participation in an incident escalation or on-call rotation may be required. The stated pay range is $146,000–$155,000 USD.

Requirements

Five or more years of information security experience, including substantial experience in incident response, security operations, detection and response, or a related discipline.
Demonstrated experience leading or coordinating security incidents across technical and business teams, with a strong understanding of the full incident response lifecycle.
Experience developing, maintaining, and testing incident response plans, procedures, and playbooks.
Experience working with an MSSP, MDR provider, SOC, or other managed security partner.
Working knowledge of security monitoring, SIEM, endpoint security, cloud security, vulnerability management, identity and access management, and network security; experience using logs and technical evidence to investigate security events.
Experience with cloud-based environments, particularly AWS, and security considerations for multi-account cloud architectures.
Knowledge of recognized security and incident response frameworks, such as NIST CSF, NIST SP 800-61, and the SANS incident response process.
Experience supporting security or compliance programs such as PCI DSS, SOC 2, ISO 27001, or similar frameworks.
Strong written and verbal communication skills, including the ability to produce clear incident documentation and communicate technical findings, risks, and recommendations to technical responders and business leaders.
Ability to work independently, establish priorities, make sound decisions, and drive initiatives through completion in high-pressure or time-sensitive situations.
Experience leading tabletop exercises involving executive leadership, Legal, Compliance, Engineering, and external service providers.

Nice To Haves

Experience with detection engineering and security operations, including detection coverage and tuning, false-positive reduction, threat hunting, digital forensics, malware analysis, or security automation.
Hands-on experience with Sumo Logic, AWS Security tools, Cloudflare, Lacework, Sophos, or similar technologies.
Experience responding to incidents involving payment card data or other regulated or sensitive information.
Familiarity with PCI DSS 4.0.1 standards and payment-brand notification processes.
Experience developing or improving a security operations program within a growing or cloud-native organization.
Experience mentoring security professionals or leading project-based, matrixed, or virtual teams.

Responsibilities

Own and continuously improve the Security Incident Response program, including policies, plans, playbooks, severity classifications, escalation criteria, communication protocols, and incident documentation.
Lead security and compliance incident response, coordinating investigation, containment, eradication, recovery, evidence preservation, and post-incident activities across technical and business teams.
Oversee MSSP governance and performance, including onboarding, service integration, escalation procedures, service reviews, contractual requirements, SLAs, detection coverage, response times, quality standards, and metrics.
Partner with the MSSP and internal teams to improve alert quality, detection rules, investigation procedures, log coverage, threat intelligence, and response automation.
Hold the MSSP accountable for contractual and operational performance; run service reviews and track deficiencies and corrective actions to closure.
Lead incident response tabletop exercises and other required testing, document lessons learned and corrective actions, and track remediation through completion.
Maintain incident response readiness through appropriate coverage, escalation capabilities, responder training, and coordination with the MSSP and designated internal responders.
Drive operational reporting on incident trends, response metrics, recurring issues, MSSP performance, control gaps, and matters requiring leadership attention.
Support the Information Security Manager with risk assessments, compliance activities, audit preparation, policy development, control reviews, vendor assessments, and remediation planning.
Advise leadership and technical teams on security events, emerging risks, operational priorities, and recommended actions, translating technical issues into clear business risks and decisions.
Participate in an incident escalation or on-call rotation as required.