Cyber Security Incident Response & Threat Intelligence Manager

We are seeking a highly skilled and strategic Cyber Security Incident Response & Threat Intelligence Manager to lead our security operations function. This role combines proactive threat intelligence with advanced incident response leadership, requiring a candidate who can anticipate emerging threats, drive strategic defenses, and lead teams through high-stakes cyber incidents.

The ideal candidate will oversee security monitoring and response capabilities, guide a team of analysts and responders, and partner cross-functionally to strengthen the organization’s security posture.

Lead and manage end-to-end response efforts during active cyber incidents, including detection, containment, eradication, and recovery

Serve as incident commander for high-severity events, ensuring timely decision-making and stakeholder communication

Oversee deep-dive forensic investigations to determine root cause, scope, and business impact

Coordinate cross-functional response efforts with IT, Legal, Compliance, and business stakeholders

Establish, maintain, and continuously improve incident response playbooks, processes, and escalation protocols

Present post-incident findings, lessons learned, and risk mitigation plans to senior leadership

Lead the development and execution of the organization’s threat intelligence strategy

Oversee research and tracking of global threat actors, campaigns, and emerging attack techniques

Ensure analysis of adversary tactics, techniques, and procedures (TTPs) aligned to frameworks such as MITRE ATT&CK

Translate threat intelligence into actionable detection use cases, defensive strategies, and business risk insights

Drive integration of threat intelligence into security tooling, detection engineering, and response playbooks

Deliver executive-level briefings and intelligence reports tailored to diverse audiences

Provide leadership oversight for proactive monitoring across endpoints, networks, and cloud environments

Guide the development of detection logic, correlation rules, and alerting strategies

Direct threat hunting initiatives to identify advanced and persistent threats

Ensure continuous tuning and optimization of security controls to improve detection fidelity and reduce false positives

Partner with engineering and architecture teams to enhance security visibility and coverage

Lead, mentor, and develop a team of incident responders, threat intelligence analysts, and SOC personnel

Establish performance expectations, career development plans, and ongoing coaching for team members

Drive operational excellence within the SOC and incident response functions

Manage vendor relationships and external partners (e.g., MSSPs, threat intelligence providers)

Develop metrics and KPIs to measure program effectiveness and maturity

Support budget planning and resource allocation for security operations

Hands-on experience with Endpoint Detection & Response (EDR) tools such as: CrowdStrike Falcon SentinelOne Microsoft Defender for Endpoint

CrowdStrike Falcon

SentinelOne

Microsoft Defender for Endpoint

Experience with NDR/XDR platforms, including: ExtraHop Cisco XDR

ExtraHop

Cisco XDR

Deep familiarity with SIEM platforms, log analysis, and security monitoring tools

Strong knowledge of networking protocols, operating systems, and cloud security concepts

Experience driving detection engineering and threat hunting programs

Lead on-call rotation strategy and provide escalation support for critical incidents

Ensure rapid and effective response to high-severity threats and vulnerabilities

Maintain strong situational awareness of the evolving threat landscape

Collaborate with internal leadership and external stakeholders during security events

Foster a culture of continuous improvement and operational resilience

Integrated into our shared values is NCR Voyix’s commitment to equal employment opportunity. All qualified applicants will receive consideration for employment without regard to sex, age, race, color, creed, religion, national origin, disability, sexual orientation, gender identity, veteran status, military service, genetic information, or any other characteristic or conduct protected by law. NCR Voyix is committed to being a globally inclusive company where all people are treated fairly, recognized for their individuality, promoted based on performance and encouraged to strive to reach their full potential. We believe in understanding and respecting differences among all people. Every individual at NCR Voyix has an ongoing responsibility to respect and support a globally diverse environment.

Statement to Third Party Agencies To ALL recruitment agencies: NCR Voyix only accepts resumes from agencies on the preferred supplier list. Please do not forward resumes to our applicant tracking system, NCR Voyix employees, or any NCR Voyix facility. NCR Voyix is not responsible for any fees or charges associated with unsolicited resumes

“When applying for a job, please make sure to only open emails that you will receive during your application process that come from a @ncrvoyix.com email domain.”