Manager, Cyber Incident Response

NBCUniversal’s Cyber Defense Operations team provides cyber threat intelligence, event monitoring, incident response, and threat hunting across the enterprise in a highly collaborative, fast-paced, and agile environment. Cyber Response Operations serves as NBCUniversal’s 24x7 first line of defense against cyber threats. Event Analysts and Incident Responders follow the Incident Response Plan to identify, assess, contain, remediate, and document cyber events and incidents.

The Manager of Cyber Incident Response leads the Incident Response team while guiding and supporting the Event Analyst function. The role oversees escalations involving containment, remediation, forensic analysis, and coordination with impacted businesses and partner teams. This leader establishes the operating rigor needed for consistent performance while enabling responders to exercise sound judgment, creativity, and ownership.

The Manager is accountable for team readiness, workflow prioritization, escalation quality, process maturity, and employee development. The role requires regular engagement with business stakeholders, Information Security Officers, technical teams, vendors, and senior leadership during both routine operations and active incidents.

Duties and Responsibilities

• Manage Incident Response operations, including prioritization, resource allocation, shift coverage, tooling requirements, workflow management, and escalation processes.
• Ensure the NBCUniversal Incident Response Plan and supporting procedures are implemented and followed in day-to-day operations.
• Oversee and manage cyber incidents across the NBCUniversal enterprise, from escalation and validation through containment, remediation, recovery support, and closure.
• Serve as an Incident Handler or Incident Commander for significant incidents, coordinating response activities with impacted businesses, technical owners, and partner teams.
• Act as the managerial escalation point for potential cyber incidents, responder support needs, and decisions requiring leadership awareness or approval.
• Participate in the manager on-call rotation for cyber incident escalation and handling in a 24x7x365 global environment.
• Supervise operational performance across shifts, ensuring consistent prioritization, ticket ownership, escalation discipline, and adherence to company standards.
• Review shift handovers, queue health, and open incidents to ensure continuity, clear accountability, and timely follow-through across operating periods.
• Maintain and enforce event and incident documentation standards, case-management requirements, key performance indicators, and process adherence.
• Monitor operational metrics and trends, identify gaps, and implement improvements that strengthen effectiveness, risk reduction, and business impact.
• Lead the review and governance of response processes, playbooks, tuning requests, automation opportunities, and technical procedures.
• Drive the maturity, enhancement, and strategy of the Incident Response program in alignment with business and enterprise priorities.
• Act as a strategic partner to Information Security Officers, business stakeholders, and other security and technology teams.
• Develop and maintain process documentation, including clear ownership, review cycles, approval requirements, and change management.
• Lead, coach, and develop Incident Response personnel, providing regular feedback and supporting technical, professional, and career growth.
• Create and deliver monthly metrics and executive reporting that communicate operational effectiveness, risk reduction, material trends, and business impact.
• Communicate incident status, operational concerns, decisions, and risk clearly to business VIPs and senior leadership.

Qualifications and Requirements

• Bachelor’s degree in an information technology-related field and/or equivalent work experience.
• Seven or more years of cybersecurity or investigations experience, including at least four years in Incident Response, a Security Operations Center, threat intelligence, or a similar function.
• Previous experience leading incident response operations, cybersecurity personnel, or complex incident coordination.
• In-depth understanding of cyber threats, adversary techniques, response procedures, network and enterprise architecture, and threat detection.
• Demonstrated ability to make evidence-based decisions under uncertainty and coordinate response activities across multiple teams.
• Willingness to work in a fast-paced, high-demand role that may require nonstandard working hours.
• Availability to support employee development and accept escalations arising in a 24x7x365 global environment.
• Strong organizational skills and the ability to manage multiple workstreams, incidents, and escalation paths.
• Working knowledge of core enterprise technology concepts, including web application architecture, networking, identity, endpoint, email, and cloud services.
• Experience with host-based and network-based forensic tools and analysis.
• Knowledge of recognized security and analysis frameworks, including MITRE ATT&CK, the Cyber Kill Chain, the Diamond Model, and NIST incident response guidance.
• Experience applying security concepts in AWS, Azure, and/or Google Cloud Platform environments.
• Knowledge of incident response technologies and capabilities such as EDR, XDR, SOAR, case management, and response automation.
• Experience developing or improving incident-management processes, playbooks, metrics, or automation.
• Exceptional written and verbal communication skills, including the ability to brief technical professionals, business stakeholders, and senior executives.
• Strong leadership, coaching, interpersonal, and problem-solving skills, with the ability to adapt to changing and fast-paced environments.

Desired Characteristics

• Prior experience managing a Cyber Incident Response, Security Operations Center, or related cyber defense function.
• Experience supporting incident response or SOC operations for a large, complex, or global enterprise.
• Hands-on familiarity with endpoint detection and response, forensic, network-analysis, email-security, and cloud-security technologies.
• Relevant security certifications such as GCIH, GCFA, GNFA, GCIA, CISSP, or equivalent.
• Demonstrated success improving operational discipline, employee development, cross-team coordination, and executive communication.

Additional Requirements:

Fully Remote: This position has been designated as fully remote, meaning that the position is expected to contribute from a non-NBCUniversal worksite, most commonly an employee’s residence.

This position is eligible for company sponsored benefits, including medical, dental and vision insurance, 401(k), paid leave, tuition reimbursement, and a variety of other discounts and perks. Learn more about the benefits offered by NBCUniversal by visiting the Benefits page of the Careers website. Salary range $110k - $170k (bonus eligible)

As part of our selection process, external candidates may be required to attend an in-person interview with an NBCUniversal employee at one of our locations prior to a hiring decision. NBCUniversal's policy is to provide equal employment opportunities to all applicants and employees without regard to race, color, religion, creed, gender, gender identity or expression, age, national origin or ancestry, citizenship, disability, sexual orientation, marital status, pregnancy, veteran status, membership in the uniformed services, genetic information, or any other basis protected by applicable law.

For LA County and City Residents Only:  NBCUniversal will consider for employment  qualified applicants with criminal histories, or arrest or conviction records, in a manner  consistent with relevant legal requirements, including the City of Los Angeles' Fair Chance Initiative For Hiring Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, where applicable.