Manager, Cyber Incident Response

NBCUniversal•Orlando, FL

11h•Remote

About The Position

NBCUniversal’s Cyber Defense Operations team provides cyber threat intelligence, event monitoring, incident response, and threat hunting across the enterprise. Cyber Response Operations serves as the company’s 24x7 first line of defense against cyber threats. The Manager of Cyber Incident Response leads the Incident Response team while guiding and supporting Event Analysts. The role oversees escalations involving containment, remediation, forensic analysis, and coordination with impacted businesses and partner teams. The Manager establishes consistent operational practices while enabling responders to exercise sound judgment, creativity, and ownership. The position is accountable for team readiness, workflow prioritization, escalation quality, process maturity, and employee development. It requires regular engagement with business stakeholders, Information Security Officers, technical teams, vendors, and senior leadership during routine operations and active incidents. This is a fully remote position and participates in a 24x7x365 global incident-response environment.

Requirements

Bachelor’s degree in an information technology-related field and/or equivalent work experience.
Seven or more years of cybersecurity or investigations experience, including at least four years in Incident Response, a Security Operations Center, threat intelligence, or a similar function.
Previous experience leading incident response operations, cybersecurity personnel, or complex incident coordination.
In-depth understanding of cyber threats, adversary techniques, response procedures, network and enterprise architecture, and threat detection.
Ability to make evidence-based decisions under uncertainty and coordinate response activities across multiple teams.
Willingness to work in a fast-paced, high-demand role that may require nonstandard working hours.
Availability to support employee development and accept escalations arising in a 24x7x365 global environment.
Strong organizational skills and ability to manage multiple workstreams, incidents, and escalation paths.
Working knowledge of enterprise technology concepts, including web application architecture, networking, identity, endpoint, email, and cloud services.
Experience with host-based and network-based forensic tools and analysis.
Knowledge of security and analysis frameworks, including MITRE ATT&CK, the Cyber Kill Chain, the Diamond Model, and NIST incident response guidance.
Experience applying security concepts in AWS, Azure, and/or Google Cloud Platform environments.
Knowledge of incident response technologies and capabilities such as EDR, XDR, SOAR, case management, and response automation.
Experience developing or improving incident-management processes, playbooks, metrics, or automation.
Exceptional written and verbal communication skills, including the ability to brief technical professionals, business stakeholders, and senior executives.
Strong leadership, coaching, interpersonal, and problem-solving skills, with the ability to adapt to changing and fast-paced environments.

Nice To Haves

Prior experience managing a Cyber Incident Response, Security Operations Center, or related cyber defense function.
Experience supporting incident response or SOC operations for a large, complex, or global enterprise.
Hands-on familiarity with endpoint detection and response, forensic, network-analysis, email-security, and cloud-security technologies.
Relevant security certifications such as GCIH, GCFA, GNFA, GCIA, CISSP, or equivalent.
Demonstrated success improving operational discipline, employee development, cross-team coordination, and executive communication.

Responsibilities

Manage Incident Response operations, including prioritization, resource allocation, shift coverage, tooling requirements, workflow management, and escalation processes.
Ensure the NBCUniversal Incident Response Plan and supporting procedures are implemented and followed in day-to-day operations.
Oversee cyber incidents across the enterprise from escalation and validation through containment, remediation, recovery support, and closure.
Serve as an Incident Handler or Incident Commander for significant incidents, coordinating response activities with impacted businesses, technical owners, and partner teams.
Act as the managerial escalation point for potential cyber incidents, responder support needs, and decisions requiring leadership awareness or approval.
Participate in the manager on-call rotation for cyber incident escalation and handling in a 24x7x365 global environment.
Supervise operational performance across shifts, ensuring consistent prioritization, ticket ownership, escalation discipline, and adherence to company standards.
Review shift handovers, queue health, and open incidents to ensure continuity, clear accountability, and timely follow-through.
Maintain and enforce event and incident documentation standards, case-management requirements, key performance indicators, and process adherence.
Monitor operational metrics and trends, identify gaps, and implement improvements that strengthen effectiveness, risk reduction, and business impact.
Lead the review and governance of response processes, playbooks, tuning requests, automation opportunities, and technical procedures.
Drive the maturity, enhancement, and strategy of the Incident Response program in alignment with business and enterprise priorities.
Act as a strategic partner to Information Security Officers, business stakeholders, and other security and technology teams.
Develop and maintain process documentation, including ownership, review cycles, approval requirements, and change management.
Lead, coach, and develop Incident Response personnel, providing regular feedback and supporting technical, professional, and career growth.
Create and deliver monthly metrics and executive reporting on operational effectiveness, risk reduction, material trends, and business impact.
Communicate incident status, operational concerns, decisions, and risk to business VIPs and senior leadership.