Manager, Cyber Security Incident Response

AmTrust Financial Services•Cleveland, OH

21h•$105,000 - $160,000•Hybrid

About The Position

The Cyber Security Incident Response Manager ensures the organization is prepared to detect, analyze, contain, and recover from cyber threats and incidents while minimizing business impact. This role leads the Incident Response (IR) program, develops playbooks, manages response teams, and ensures alignment with enterprise risk management, regulatory requirements, and industry best practices. The Incident Response Manager collaborates closely with IT, Legal, Compliance, Risk, and business units to strengthen cyber resilience and improve detection, response, and recovery capabilities across the enterprise.

Requirements

Bachelor’s degree from an accredited college or university in Cyber Security, Information Technology, or a related field.
Demonstrated experience leading cyber incident response in a large enterprise or highly regulated industry.
Strong technical expertise in digital forensics, malware analysis, SIEM/EDR tools, and network intrusion detection.
Proven ability to manage high-pressure situations and provide clear, timely communication to both technical teams and executives.
Familiarity with legal, regulatory, and compliance requirements for cyber incidents, including breach notification laws.
Excellent written and verbal communication skills, capable of translating complex technical findings into executive-level reports.
Strong organizational, analytical, and problem-solving abilities.

Nice To Haves

Industry certifications preferred: GCIH, GCFA, GCIA, GNFA, CISM, or CISSP.

Responsibilities

Lead the Cyber Security Incident Response (CSIR) program, ensuring rapid detection, containment, eradication, and recovery of cyber incidents.
Develop and maintain IR processes, runbooks, and playbooks for various attack scenarios (e.g., ransomware, phishing, insider threat, data breach, business email compromise).
Serve as primary point of contact and coordinator during cyber incidents, engaging technical teams, executive leadership, and external stakeholders.
Manage and continuously improve incident response technologies including SIEM, SOC, SOAR, EDR, threat intelligence platforms, and case management tools.
Perform forensic analysis and root cause investigations of incidents; ensure lessons learned are documented and remediation activities are tracked.
Conduct tabletop exercises, red team/blue team simulations, and coordinate post-incident reviews.
Maintain an up-to-date incident escalation matrix and ensure 24/7 coverage/rotation for incident handling.
Partner with threat intelligence, vulnerability management, and SOC teams to proactively reduce incident risk.
Collaborate with Legal, HR, Risk, and Compliance during investigations to ensure appropriate evidence handling, reporting, and regulatory notifications.
Track, analyze, and report on incident metrics, response times, and overall program effectiveness to senior leadership.
Ensure incident response procedures remain aligned with frameworks such as NIST 800-61, ISO 27035, and regulatory requirements (e.g., NYDFS 500, GDPR, HIPAA).
Engage with law enforcement and external partners as needed during significant cyber events.