Serve as Incident Commander for security and operational incidents, holding full command and control over response activities.
Build, execute, and maintain Incident Action Plans (IAPs) that give each response a clear structure, owner, and timeline.
Make time-sensitive decisions under pressure, weighing safety, regulatory exposure, and business continuity.
Lead post-incident reviews and drive corrective actions through to closure.
Run tabletop exercises and simulations to pressure-test playbooks and team readiness.
Manage physical security incidents, including unauthorized access, safety threats, and facility disruptions.
Coordinate with Facilities, HR, Legal, and local authorities as needed during physical security events.
Act as the central point of coordination between technical responders and non-technical stakeholders during an incident.
Support the SOC 2 compliance program (Type I and Type II) — assisting with control ownership, evidence collection, auditor coordination, and remediation tracking.
Define and track incident response metrics (e.g., time to detect, time to contain, time to resolve, recurrence rate) to measure program maturity.
Maintain incident response plans, IAP templates, and after-action reports.

3–5 years of experience in incident response, GRC, or risk management, preferably in a regulated environment such as fintech or financial services.
Direct experience serving as Incident Commander or in a comparable incident leadership role, including running IAPs and post-incident reviews.
Familiarity with SOC 2 and GLBA Safeguards Rule compliance programs; working knowledge of ISO/IEC 27001.
Experience building and tracking KPIs/metrics for incident response and compliance programs.
Strong written documentation skills; comfortable producing audit-ready records under time pressure.
Professional certifications such as ICS-100/200 preferred.
Bachelor’s degree in Computer Science, Information Security, or related field, or equivalent experience/certifications.

GRC & Incident Manager

Key skills