Cyber Incident Manager

• Incident Leadership: The Cyber Incident Manager is responsible for taking command during cybersecurity events, orchestrating response efforts, and promptly addressing incidents. This involves quick decision-making, prioritizing tasks, and directing response teams effectively.
• Strategic Planning and Preparedness: Beyond reactive measures, this role demands proactive planning and preparedness. This includes developing, maintaining, and regularly updating incident response plans, ensuring the organization is equipped to handle various cyber incidents. It also involves conducting risk assessments and scenario planning (tabletop exercises) to anticipate potential threats and vulnerabilities.
• Coordination and Collaboration: The position requires extensive coordination with various internal departments (e.g., IT, Legal, HR, and public relations) and external entities (such as law enforcement, cybersecurity firms, and regulatory bodies). This coordination is crucial for a holistic approach to incident management, encompassing technical response, legal compliance, internal and external communications, and post-incident recovery.
• Technical Expertise and Analysis: The Cyber Incident Manager should deeply understand the cyber threat landscape, including the latest trends in cyber-attacks and defense strategies. They are expected to analyze incident patterns and weaknesses, offering insights that drive improvements in the organization’s cybersecurity posture.
• Stakeholder Engagement: Effective communication with stakeholders, including executive leadership, is a key aspect of this role. The Cyber Incident Manager must be able to translate complex technical incidents into understandable terms, advising on the impact, necessary actions, and implications for the business.
• Continuous Improvement and Learning: Post-incident analysis is a critical function. Learning from incidents to improve systems, processes, and training is essential. This role involves regularly reviewing and refining incident response strategies, staying informed about new technologies and methodologies in cybersecurity, and integrating these into the organization’s practices.
• Regulatory Compliance and Documentation: Ensuring that incident response activities adhere to legal and regulatory requirements is paramount. The Cyber Incident Manager maintains comprehensive records of incidents, responses, and outcomes for compliance purposes, audits, and continuous improvement.
• Risk Mitigation: By effectively managing cyber incidents, this role directly contributes to reducing the risk and impact of cyber threats on the organization.
• Operational Continuity: Ensuring rapid and efficient response to incidents minimizes downtime and maintains business operations, which is crucial for the organization’s success and reputation.
• Compliance and Trust: Adherence to compliance standards and effective incident handling enhances the organization's credibility and trust among clients, partners, and regulatory bodies.

• Bachelor's degree from four-year college or university.
• 3-5 years of related experience.
• Technical Skills:

• Digital Forensics & Incident Response (DFIR)
• Security Information and Event Management (SIEM) (e.g., Splunk, Sentinel, QRadar)
• Intrusion Detection/Prevention Systems (IDS/IPS)
• Endpoint Detection & Response (EDR) (e.g., CrowdStrike, Darktrace, SentinelOne)
• Network Traffic Analysis & Packet Capture (Wireshark, etc.)
• Malware Analysis & Reverse Engineering (basic to intermediate)
• Log Correlation and Threat Hunting
• Firewall, Proxy, and IDS Log Analysis (e.g., Fortinet, Meraki)
• Threat Intelligence Integration and Analysis
• Email Header and Phishing Analysis
• Security Orchestration, Automation, and Response (SOAR) platforms (e.g., Palo Alto XSOAR, Swimlane)
• Forensics Tools: EnCase, FTK, Autopsy, Volatility
• Threat Intel Platforms: Recorded Future, ThreatConnect, MISP
• Ticketing Systems: ZenDesk, ServiceNow, Jira, Remedy * Framework Proficiency:

• Incident Response Lifecycle (NIST SP 800-61, PICERL model)
• Knowledge of MITRE ATT&CK Framework
• Vulnerability Management & Prioritization
• Disaster Recovery & Business Continuity Planning (e.g., DR/BC, BIA)
• Risk Assessment & Gap Analysis
• Change Control and Root Cause Analysis (RCA) * Regulatory, Compliance, and Privacy Awareness:

• HIPAA, PCI-DSS, NY SHIELD, GDPR, CCPA, CJIS, etc.
• SOX ITGC Controls and Audit Support
• Cyber Insurance (CLI) & Legal Considerations in Breach Response
• Chain of Custody and Evidence Handling * Leadership and Management Skills:

• Relevant certifications (e.g., CISSP, CISM, GCIH, GCFA, CRISC).
• Collaboration: Confluence, MS Teams, Slack, Monday.com, Telegram (war room coordination)
• Strong leadership and decision-making.
• Excellent communication and interpersonal skills.
• Deep understanding of cybersecurity frameworks and standards.
• Ability to work under pressure and handle crises effectively.

• Generous Medical, Dental, Vision Benefits
• TSA paid Life Insurance for Employees
• Additional life insurance options for employees
• On-site cafeteria
• Paid Time Off – Vacation, Sick, Personal day
• 403(b) retirement savings plan
• Non-contributory Pension Plan
• Professional Development
• Free, on-site Fitness Center
• Federal holidays
• Opportunities to give back and support our communities

The Salvation Army