Sr Manager, Security Incident Response

Lowe's Companies, Inc.•Charlotte, NC

About The Position

The Sr Manager, Security Incident Response leads and coordinates the end-to-end management of cybersecurity incidents across the enterprise. The role is the central coordination point during significant security events, bringing together security, technical, legal, privacy, communications, and business stakeholders. It ensures the organization responds quickly and consistently, minimizes business disruption and security exposure, maintains executive visibility, and turns incident lessons into measurable improvements in cyber resilience. The position combines technical understanding with incident leadership, decision-making, communication, and executive stakeholder management. The role requires composure when information is incomplete or rapidly changing, the ability to influence teams without direct authority, and the judgment to align technical responders, business leaders, and executives around incident risk and status.

Requirements

Bachelor’s degree in Computer Science, CIS, Engineering, Business Administration, Cybersecurity, or a related field, or equivalent years of experience in lieu of the education requirement, if applicable.
8 years of IT experience with broad exposure to business/system planning, analysis, and application development.
3 years of experience leading project or technical teams, with or without formal direct-report responsibility.
4 years of experience with information security tools, concepts, and practices.
Experience managing projects and project resources to meet goals across simultaneous or multiple projects.
Strong technical understanding, incident leadership, communication, decision-making, and executive stakeholder management capabilities.
Ability to remain composed during critical incidents and establish clarity when information is incomplete or rapidly changing.
Ability to influence teams without direct authority and align technical, business, and executive stakeholders.
Ownership, accountability, collaboration, resilience, empathy, sound judgment, and executive presence.
Ability to adapt communication for technical responders, business leaders, and C-suite executives while maintaining a consistent view of incident risk and status.

Nice To Haves

10+ years of cybersecurity or IT experience, with significant experience in Security Operations, Incident Response, Cyber Defense, Digital Forensics, or related disciplines.
Demonstrated experience managing major security incidents in complex enterprise environments.
Strong knowledge of SIEM/SOAR, EDR/XDR, network security, cloud security, identity and access management, threat intelligence, ransomware response, vulnerability management, and forensic investigation.
Strong leadership under pressure, structured problem-solving, stakeholder management, conflict resolution, and executive communication skills.
Ability to coordinate multiple technical and business teams while balancing containment decisions with operational and business impact.

Responsibilities

Lead the cybersecurity incident lifecycle from identification and triage through containment, eradication, recovery, closure, and post-incident review.
Serve as Incident Commander for high-severity and enterprise-impacting cybersecurity incidents; establish severity, business impact, escalation requirements, and response priorities.
Coordinate SOC, Incident Response, Digital Forensics, Threat Intelligence, Offensive Security, Vulnerability Management, Identity, Cloud, Network, Endpoint, Application Security, and infrastructure teams.
Lead incident bridges and war rooms, maintaining ownership, action tracking, decision logs, timelines, and escalation paths.
Translate technical findings into clear business and risk language for senior executives and provide timely executive situation reports.
Partner with Legal, Privacy, Compliance, Corporate Communications, HR, and business leadership when incidents have regulatory, privacy, employee, customer, or reputational implications.
Ensure evidence preservation and forensic processes are followed during investigations.
Drive root-cause analysis and post-incident reviews, and track corrective actions and lessons learned through completion.
Identify recurring incident patterns and recommend improvements to detection, response automation, security controls, processes, and technology.
Develop and maintain incident response playbooks, escalation matrices, communication protocols, and crisis management procedures.
Improve incident response maturity, preparedness, and collaboration across Security, Technology, and business organizations.
Conduct tabletop exercises and cyber simulations covering ransomware, data breaches, compromised credentials, cloud incidents, insider threats, and supply-chain attacks.
Define and track operational metrics, including MTTD, MTTA, MTTC, MTTR, incident volume, severity trends, recurrence rates, and response effectiveness.
Provide technical direction, thought leadership, coaching, and mentoring to team members.
Manage projects and project resources to meet goals across simultaneous or multiple projects.