Manager, Incident Response

Newell Brands•Atlanta, GA

About The Position

The Cyber Security Manager, Incident Response reports to the Senior Manager of Security Operations and serves as the senior-most technical leader within Newell Brands Security Operations. The role is the primary Incident Commander under the Cyber Security Incident Response Plan (CSIRP), owning end-to-end coordination for high-severity and critical security incidents across the company’s global environment. In addition to incident response, the manager sets technical direction for Security Operations, leads detection engineering, automation and control-improvement initiatives, and directs day-to-day operational execution. This is a hands-on position requiring current incident-response and security-engineering expertise, operational judgment to run a modern SOC, and the ability to turn lessons learned into durable, scalable process improvements.

Requirements

Bachelor’s degree in Information Security, Computer Science, Information Management Systems or a related field.
At least 7 years of cybersecurity experience, including at least 4 years in a dedicated Incident Response or Security Operations role.
Experience leading technical operations for a SOC or Security Operations team, including setting priorities, mentoring analysts and driving measurable operational improvement.
Demonstrated experience serving as an Incident Commander or leading responses to high-severity incidents such as ransomware, data breaches or nation-state intrusions.
Experience managing cross-functional response teams under pressure, including coordination with Legal, Communications and executive stakeholders.
Experience managing and directing external incident-response retainer engagements and third-party forensic vendors.
Hands-on expertise in endpoint and network-based forensic investigation, malware analysis and log-based intrusion analysis.
Practical security-engineering experience developing SIEM detection content, authoring SOAR playbooks and scripting security automation in Python, PowerShell or equivalent.
Ability to provide security-control recommendations and architecture guidance across endpoint, network, cloud (Azure, M365) and identity environments.
Strong knowledge of network protocols, operating-system internals and application-layer vulnerabilities, along with corresponding risk mitigations.

Nice To Haves

Prior experience in a Fortune 500 or complex global enterprise environment.
One or more of the following certifications, or similar: GIAC Certified Incident Handler (GCIH), BTL2 (Security Blue Team Level 2), OffSec Defense Analyst (OSDA), or Certified Information Systems Security Professional (CISSP).

Responsibilities

Serve as primary Incident Commander under the Newell Brands CSIRP, leading response activities across CSIRT functional teams for high-severity and critical incidents.
Make and communicate time-sensitive decisions to contain incidents, prevent escalation and restore normal operations efficiently.
Coordinate response across Security Operations, IT, Legal, HR, Corporate Communications, Privacy and other teams, aligning activities with CSIRP priorities.
Determine when to activate external incident-response retainer resources, manage vendor relationships during engagements and ensure evidentiary integrity.
Lead post-incident reviews and after-action analysis, document findings and drive corrective actions to reduce recurrence.
Maintain and improve CSIRP documentation, incident runbooks and playbooks; conduct tabletop exercises and simulation drills at least annually.
Develop and recommend security-control improvements based on incident findings, threat intelligence and gap assessments across endpoint, network, identity and cloud environments.
Design, build and maintain detection engineering content, including SIEM correlation rules, behavioral analytics and custom signatures, to improve fidelity and reduce mean time to detect.
Lead Security Operations workflow automation, including alert triage, enrichment, containment actions and case-management integrations using SOAR/XSOAR or equivalent.
Evaluate emerging security technologies and make evidence-based recommendations for tooling investments.
Collaborate with IT and infrastructure teams to validate security-control implementation and test controls through adversary simulation and purple-team activities.
Lead day-to-day Security Operations, directing SOC monitoring, alerting and triage to maintain operational coverage and response readiness across global time zones.
Set the SOC’s technical direction and continuous-improvement roadmap, prioritizing work that reduces risk and improves detection and response performance.
Provide senior technical leadership and mentorship to SOC analysts, improving investigation quality and accelerating skill development.
Own the Security Operations KPI and metrics program and use it to demonstrate SOC maturity and risk-reduction improvements to leadership.
Maintain an in-depth understanding of threats relevant to a global consumer goods company and ensure operational coverage reflects the threat profile.
Develop and maintain relationships with stakeholders across IT, Legal, HR, Privacy, Ethics and business unit leadership.
Represent Security Operations in the information security community to identify emerging threats, intelligence and techniques that may affect Newell Brands.