Incident Response Manager

Who you are

• Digital Forensics & Incident Response (DFIR)
• Leadership and Team Development
• Incident Command and Crisis Management
• Cyber Extortion and Ransomware Response
• Executive Communication
• Customer Relationship Management
• Strategic Planning
• Operational Excellence
• Process Development and Standardization
• Performance Metrics and Reporting
• Cloud and Enterprise Incident Response
• Investigation Quality Assurance
• Resource Planning and Utilization Management
• Stakeholder Management
• Cross-Functional Collaboration
• Project and Program Management
• 3+ years of experience leading technical teams, people management, or service delivery organizations
• Demonstrated experience leading complex cyber incident investigations and recovery efforts
• Strong knowledge of host, network, cloud, and enterprise forensic analysis
• Experience managing customer-facing engagements involving legal counsel, cyber insurance carriers, and executive stakeholders
• Exceptional verbal and written communication skills
• Experience developing operational processes, performance metrics, and quality assurance programs
• Ability to lead multiple concurrent initiatives and prioritize effectively in high-pressure environments
• Fluency in English, verbal and written
• Bachelor's degree in Information Security, Digital Forensics, Computer Science, Cybersecurity, or a related discipline
• Industry certifications such as GCFA, GCFE, CISSP, GCIH, EnCE, ACE, or equivalent
• Experience within consulting, managed security services, or incident response service organizations
• Experience presenting at industry conferences, customer events, or technical forums
• Experience supporting large-scale enterprise incident response programs and global service delivery teams

What the job involves

• The Manager, Incident Response is responsible for leading and maturing Arctic Wolf's Incident Response practice by combining strategic leadership, operational management, and advanced technical incident response expertise
• This role leads and develops a team of Incident Response professionals while maintaining the technical depth required to support and lead complex investigations, cyber extortion events, ransomware engagements, business email compromise matters, and large-scale recovery efforts
• The Manager is accountable for delivering world-class incident response services, ensuring operational excellence, maintaining technical quality standards, driving process improvements, developing team capabilities, and supporting organizational growth
• This individual serves as both a management leader and a senior technical escalation resource capable of leading the most complex investigations and customer engagements
• Team Leadership & People Management
• Lead, mentor, develop, and manage a hybrid/remote team of Incident Response professionals
• Ensure operational standardization across delivery regions
• Recruit, hire, onboard, train, and retain top DFIR talent
• Conduct performance reviews, career development planning, coaching sessions, and succession planning
• Foster a culture of collaboration, accountability, technical excellence, and continuous improvement
• Ensure team members receive exposure to a variety of investigative and recovery activities to support career growth
• Lead team development initiatives through formal mentoring, peer coaching, technical reviews, and knowledge-sharing programs
• Serve as an escalation point for personnel, client, and delivery-related issues
• Incident Response Operations
• Oversee the delivery of Incident Response services to ensure consistent, scalable, and high-quality outcomes
• Scope incoming matters, monitor, and manage incident response engagements across the team
• Assign personnel to engagements based on skillsets, availability, customer needs, and goals
• Maintain awareness of all active investigations and recovery efforts, stepping in when escalation or leadership intervention is required
• Ensure proper case management practices, utilization targets, resource planning, scheduling, and workload balancing
• Develop and implement operational processes, standards, and quality assurance mechanisms
• Review incident reports, executive summaries, investigative findings, and customer deliverables prior to delivery
• Establish and maintain key performance indicators (KPIs), service metrics, and operational reporting capabilities
• Drive continuous improvement initiatives that enhance efficiency, consistency, customer satisfaction, and service quality
• Provide technical leadership and mentorship to team members throughout engagements and forensic activities
• Technical Incident Response & Forensics
• Lead and support advanced digital forensic and incident response investigations
• Conduct and oversee host, network, cloud, and log-based forensic analysis
• Perform investigative activities involving Windows, Linux, macOS, Azure, AWS, and Google Cloud environments
• Guide containment, eradication, recovery, and remediation activities during active security incidents
• Validate investigative findings and technical conclusions developed by team members
• Develop complex investigation strategies and incident response plans for customer environments
• Conduct forensic analysis through collected evidence to determine threat actor activity and timeline, identify persistent mechanisms, data impact and indicators of compromise
• Maintain expert-level knowledge of emerging threats, attack methodologies, ransomware trends, and DFIR best practices
• Participate directly in the most complex, high-risk, or high-visibility engagements, when required
• Customer & Stakeholder Engagement
• Serve as a senior trusted advisor during active cybersecurity incidents
• Communicate technical findings to executive leadership, legal counsel, insurance carriers, and technical stakeholders
• Lead scoping discussions and engagement planning for new incident response matters
• Support cyber extortion and ransomware negotiation strategy development and approval
• Present recovery plans, investigative findings, and strategic recommendations to customer stakeholders
• Build and maintain relationships with legal counsel, cyber insurance carriers, strategic partners, and customers
• Support business development activities, attend industry events, and thought leadership initiatives as needed
• Recommend Arctic Wolf solutions and services where appropriate based on customer needs
• Strategic Leadership & Program Development
• Partner with Directors and Executive Leadership to execute the vision, strategy, and growth plans for the Incident Response organization
• Identify opportunities for automation, innovation, tooling improvements, and operational efficiencies
• Define and standardize processes, methodologies, documentation, and service delivery frameworks
• Drive reporting and analytics initiatives that demonstrate business impact, customer outcomes, operational efficiency, and risk reduction
• Collaborate across Product, Engineering, Security Operations, Concierge, MDR, Sales, Marketing, and Customer Success teams
• Support strategic planning, budgeting, forecasting, workforce planning, and organizational scaling initiatives
• Champion quality assurance programs, service delivery excellence, and customer experience improvements
• General Responsibilities
• Create and participate in escalation, evening, weekend, and holiday on-call rotations
• Conduct peer reviews, quality reviews, and case audits
• Promote information sharing, documentation, and organizational learning
• Maintain required technical certifications and professional development goals
• Perform other duties as assigned in support of Arctic Wolf's Incident Response mission and organizational objectives

Benefits

• Equity For All Employees: Our salary and benefits packages always include equity, so every employee has a stake in the company’s success
• Pack Unity: We’re on a mission to foster a diverse, equitable, and inclusive workplace and to create positive change in and out of the office
• Professional Development: Arctic Wolf mentors and trains its employees to help their career growth, and encourages and supports employee efforts to enhance their skills and competency through coursework and training
• Flexible Paid Time Off: Arctic Wolf believes that employees should have the opportunity to enjoy time away from work on a flexible basis. Employees are given accountability and authority within their job responsibilities, why not with their flexible time off? We encourage diversity and the ability for you to celebrate the days in the year that are important to you
• Family Forming Benefits: Your family is a part of our Pack, which is why in addition to comprehensive health benefits, we provide access to personalized family-forming support for employees exploring fertility health, those pursuing parenthood, those already pregnant, and other family related benefits
• Volunteer Time Off: As we seek to End Cyber Risk, we also seek to give back to the communities around us, so the world is a safer and better place for all to thrive. All pack members have 3 days of volunteer time off (VTO) to use to give back to their communities in a way that is meaningful to them