Sr Manager, Cybersecurity Incident Management

Lowes•Charlotte, NC

About The Position

The Sr Manager, Cybersecurity Incident Management leads and coordinates the end-to-end management of cybersecurity incidents across the enterprise. The role serves as the central point of coordination during significant security events, bringing together Security Operations, Incident Response, Forensics, Threat Intelligence, Infrastructure, Cloud, Network, Application, Identity, Legal, Privacy, Communications, and business stakeholders. The role ensures the organization responds quickly, consistently, and decisively to cybersecurity events; minimizes business disruption and security exposure; maintains effective executive visibility; and turns incident lessons into measurable improvements in enterprise cyber resilience. It requires strong technical understanding, incident leadership, communication, decision-making, and executive stakeholder management.

Requirements

Bachelor’s degree in Computer Science, CIS, Engineering, Business Administration, Cybersecurity, or a related field, or equivalent years of experience in lieu of the education requirement, if applicable.
8 years of IT experience with broad exposure to business/system planning, analysis, and application development.
3 years of experience leading project or technical teams, with or without formal direct-report responsibility, including technical direction, thought leadership, coaching, and mentoring.
4 years of experience with information security tools, concepts, and practices.
Experience managing projects and project resources to meet goals across simultaneous or multiple projects.

Nice To Haves

10+ years of cybersecurity or IT experience, with significant experience in Security Operations, Incident Response, Cyber Defense, Digital Forensics, or related disciplines.
Demonstrated experience managing major security incidents in complex enterprise environments.
Strong knowledge of SIEM/SOAR, EDR/XDR, network security, cloud security, identity and access management, threat intelligence, ransomware response, vulnerability management, and forensic investigation.
Strong leadership under pressure, structured problem-solving, stakeholder management, conflict resolution, and executive communication skills.
Ability to coordinate multiple technical and business teams while balancing containment decisions with operational and business impact.

Responsibilities

Lead the cybersecurity incident lifecycle from identification and triage through containment, eradication, recovery, closure, and post-incident review.
Act as Incident Commander for high-severity and enterprise-impacting incidents; establish severity, business impact, escalation requirements, and response priorities.
Coordinate Security Operations, Incident Response, Digital Forensics, Threat Intelligence, Offensive Security, Vulnerability Management, Identity, Cloud, Network, Endpoint, Application Security, and infrastructure teams.
Lead incident bridges and war rooms, maintaining ownership, action tracking, decision logs, timelines, and escalation paths.
Translate technical findings into clear business and risk language for senior executives and provide timely situation reporting.
Partner with Legal, Privacy, Compliance, Corporate Communications, HR, and business leadership when incidents involve regulatory, privacy, employee, customer, or reputational implications.
Ensure evidence preservation and forensic processes are followed during investigations.
Drive root-cause analysis and post-incident reviews; track corrective actions and lessons learned through completion.
Identify recurring incident patterns and recommend improvements to detection, response automation, security controls, processes, and technology.
Develop and maintain incident response playbooks, escalation matrices, communication protocols, and crisis management procedures.
Improve incident response maturity, preparedness, and collaboration across Security, Technology, and business organizations.
Conduct tabletop exercises and cyber simulations covering ransomware, data breaches, compromised credentials, cloud incidents, insider threats, and supply-chain attacks.
Define and track operational metrics such as MTTD, MTTA, MTTC, MTTR, incident volume, severity trends, recurrence rates, and response effectiveness.
Remain composed during critical incidents and establish clarity when information is incomplete or rapidly changing.
Influence teams without direct authority and create alignment across technical, business, and executive stakeholders.
Demonstrate ownership, accountability, collaboration, resilience, empathy, sound judgment, and executive presence.
Adapt communication for technical responders, business leaders, and C-suite executives while maintaining a consistent view of incident risk and status.