Senior Cybersecurity Operations & Incident Response LeadPosition Overview Job Title: Senior Cybersecurity Operations & Incident Response Lead

Location:
Work from home Arrangement: Remote Compensation: To be aligned with the more senior scope of the role Experience Level: Senior / Lead-level cybersecurity operations Language Requirement: English rand French Certifications: Beneficial but not mandatory People Leadership: One Endpoint Security Analyst reporting into this role Primary Focus: Cybersecurity operating framework, cloud infrastructure security, incident-management ownership, executive and client coordination, technical-team leadership, tabletop exercises, continuous improvement, and end-to-end security operations governance About the Opportunity We are seeking a Senior Cybersecurity Operations & Incident Response Lead to take ownership of the organization’s cybersecurity operating framework and incident-management process. This is not a traditional analyst role and is not intended to be a narrowly focused endpoint, SOC, or security-tool position. The successful candidate will be responsible for defining how cybersecurity incidents are identified, triaged, escalated, coordinated, communicated, resolved, documented, and improved upon. The role requires someone capable of operating at both the strategic and tactical levels: Top-down: establish the cybersecurity framework, incident-management strategy, governance model, escalation paths, operating standards, executive communication model, client communication model, and continuous-improvement roadmap. Bottom-up: understand technical detail, guide development and security teams, coordinate remediation, validate progress, challenge assumptions, track actions, and ensure incidents are driven through to full resolution. This individual will have an Endpoint Security Analyst reporting directly into the role, but will own the broader cybersecurity process across cloud, infrastructure, development, endpoint, security operations, external providers, management, and client stakeholders. The successful candidate must be comfortable leading incidents where many of the technical resources involved do not report directly to them. They will be expected to provide structure, direction, accountability, and communication throughout the entire lifecycle.

Key Responsibilities
Cybersecurity Strategy & Security Framework Ownership Create, maintain, and continually refine the organization's cybersecurity operating framework. Ensure cybersecurity responsibilities are understood across development, infrastructure, cloud, network, endpoint, security, leadership, and external partners. Translate broader security strategy into practical operational controls and measurable execution. Continuously assess process effectiveness and mature the organization's cybersecurity operating model. End-to-End Incident Management Ownership Own the entire cybersecurity incident-management process. Ensure every meaningful security incident has clear ownership, severity, scope, stakeholders, actions, timelines, communication, escalation, and closure criteria. Lead or oversee initial incident triage and impact assessment. Drive root-cause analysis, lessons learned, corrective actions,



control improvements, and recurrence-prevention activities. Maintain incident documentation, decision records, timelines, action logs, and final summaries. Executive Coordination Provide concise, timely, and accurate incident updates to executives. Translate technical incidents into business risk, operational impact, customer impact, and decision requirements. Clearly communicate what is known, what is not yet known, what actions are underway, what decisions are needed, and when the next update will occur. Support executive decision-making during high-impact security events. Establish the appropriate communication cadence based on incident severity. Maintain confidence, clarity, and structure during high-pressure situations. Client-Facing Incident Management Coordinate directly with clients when security incidents affect customer environments, services, data, commitments, or operations. Establish clear client communication during active incidents. Work with internal leadership and technical teams to ensure external communications are accurate, timely, and appropriate. Coordinate customer questions, technical responses, status updates, remediation plans, and follow-up actions. Ensure client-facing commitments made during an incident are tracked and delivered. Support post-incident client reviews where appropriate. Top-Down Strategy / Bottom-Up Tactical Execution The role must operate comfortably at both levels. Top-down responsibilities include: Security strategy Framework development Governance Risk prioritization Incident operating model Executive engagement Client engagement Metrics and reporting Security maturity planning Resource prioritization Bottom-up responsibilities include: Incident triage Technical coordination Remediation tracking Root-cause validation Action ownership Log and evidence review Control validation Technical follow-up Runbook improvement Day-to-day operational execution The strongest candidate will be able to move between these levels naturally. Tabletop Exercises & Incident Preparedness Design, plan, facilitate, and document cybersecurity tabletop exercises. Create corrective-action plans from tabletop findings. Assign owners and timelines for improvements. Track actions to completion. Incorporate lessons from tabletop exercises into updated incident processes, policies, playbooks, and training. Cloud Infrastructure Security Maintain oversight of security posture across AWS and/or Azure environments. Review cloud-security findings, alerts, posture data, logging, vulnerabilities, and infrastructure risks. Ensure cloud remediation is incorporated into the broader security-governance and incident-management process. Coordinate with cloud and infrastructure specialists rather than acting as the sole deep technical engineer.



Security Operations Leadership Establish and manage the organization's cybersecurity operating rhythm. Maintain visibility into open incidents, risks, vulnerabilities, remediation work, audit items, recurring issues, and security initiatives. Escalate stalled or high-risk issues appropriately. Drive continuous improvement across tools, processes, controls, communications, and team readiness. Endpoint Security Leadership Manage the Endpoint Security Analyst reporting into this role. Set priorities and provide operational direction. Ensure endpoint-security activities align with the broader cybersecurity framework. Oversee EDR, endpoint monitoring, endpoint remediation, reporting, and incident participation. Maintain accountability for outcomes without needing to personally perform every endpoint-security task. Audit, Compliance & Evidence Management Support cybersecurity audits and compliance activities. Coordinate evidence gathering, logs, reports, screenshots, control documentation, and audit responses. Incorporate recurring audit findings into broader security-process improvement. Ensure documentation supports traceability and accountability. Metrics, Reporting & Continuous Improvement Develop meaningful operational security metrics. Conduct post-incident reviews. Identify recurring technical or procedural weaknesses. Update playbooks, standards, controls, training, and escalation practices based on experience. Drive measurable improvement rather than simply responding to individual incidents. Required Qualifications Senior-level experience in cybersecurity operations, incident response, infrastructure security, cloud security, or security leadership. Demonstrated experience owning incident management, not simply participating as a technical responder. Experience coordinating incidents across executives, development teams, security teams, infrastructure resources, external vendors, and other stakeholders. Experience creating, implementing, or materially improving cybersecurity frameworks, incident processes, playbooks, governance models, or operating procedures. Strong experience managing incidents from initial detection through remediation, recovery, closure, and lessons learned. Experience leading root-cause analysis and corrective-action processes. Experience translating cybersecurity events into business and executive-level communication. Experience working directly with clients or external stakeholders during technical or security incidents. Practical understanding of AWS and/or Azure security concepts. Strong infrastructure-security understanding. Broad networking knowledge sufficient to work effectively with networking specialists. Strong leadership, facilitation, communication, organization, and decision-making skills. Ability to influence technical teams that may not report directly into the role. Ability to operate independently in a remote environment. Strong follow-through and accountability orientation. Ability to manage multiple incidents, risks, stakeholders, and priorities concurrently. The successful candidate must therefore be able to lead through both authority and influence, coordinate resources across organizational boundaries, and maintain accountability from incident discovery through final resolution.

📌 Senior Cybersecurity Operations (Canada)
🏢 bbg talent acquisitions
📍 Canada