Job Description: Cybersecurity Incident Manager (Technology Operations)

Role purpose

The Cybersecurity Incident Manager is accountable for leading the end-to-end Incident Management lifecycle for cybersecurity technology services. The role ensures incidents are triaged quickly, coordinated effectively across technical teams, communicated clearly to stakeholders, and resolved with a strong focus on service restoration, operational risk reduction, and learning.

As part of the Global Cybersecurity Service Resilience (CSR) team, you’ll help ensure the highest standards of availability and security are maintained across Cybersecurity tooling, and that the function maintains capability during significant organizational disruption.

Key accountabilities

• Own and drive the end-to-end Incident Management lifecycle (identification, logging, triage, prioritisation, coordination, service restoration, closure).
• Lead major incident execution for cybersecurity technology incidents: establish bridges, confirm roles, drive actions, manage timelines, remove blockers, and escalate appropriately.
• Coordinate response for incidents impacting critical cybersecurity technologies across Endpoint Security, Data Security, Network Security, Application Security and SIEM/SOAR
• Partner with engineering/operations teams to analyze, investigate and remediate cybersecurity application incidents in operational/production environments.
• Ensure effective engagement of SMEs and dependent teams to restore service safely and quickly.
• Provide clear, timely, audience-appropriate communications to stakeholders (service owners, cyber leadership, technology partners, impacted teams), including regular situation updates and recovery expectations.
• Operate in accordance with ITIL-aligned processes (Incident, Change Management, Problem Management).
• Partner closely with the Problem Manager to ensure effective hand-offs (e.g., major incident follow-up into problem, repeat incident reduction, known errors/workarounds).

Requirements

• Demonstrable experience in IT Service Management, with significant hands-on experience in Incident Management (including major incident coordination) in a complex, multi-team environment.
• Strong working knowledge of ITIL-aligned practices, especially Incident, Problem and Change Management and how they interact to improve service stability.
• Experience using service management tooling (e.g., ServiceNow or equivalent) to manage incident workflows, communications, reporting and knowledge artefacts.
• Strong analytical and problem-solving skills — ability to assess impact, drive triage, and develop a resolution plan quickly, leveraging all available resources.
• Clear written and verbal communication skills, able to articulate complex concepts to a broader audience.
• Strong ownership mindset and accountability to ensure actions complete and outcomes are delivered.

Cybersecurity technology knowledge (required for this role)

• Good working understanding of cybersecurity technology domains and common operational failure modes.
• Relevant experience supporting/operating or coordinating incidents for cybersecurity tooling in one or more areas (exposure to at least two is preferred):
• Endpoint security (CrowdStrike or any EDR solution)
• Network security (NAC solutions, network segmentation, web proxy solutions)
• Application security (Nessus/Tenable, container/Docker security)
• Data Security (industry leading DLP technology such as Symantec or McAfee DLP)
• SIEM/SOAR (Splunk ES, Splunk SOAR)
• Familiarity with Unix and Windows operating systems