Cyber Security Exposure Response Lead

Allstate Insurance Co. is hiring a Cyber Security Exposure Response Lead to investigate critical vulnerabilities and exposures, determine enterprise impact, and coordinate response toward risk reduction. The role leads exposure events, engages SOC and Incident Response teams when compromise is suspected, and develops analysts while maintaining operational continuity across handoffs.

Responsibilities:

• Hands-On Exposure Investigation : Investigate newly disclosed CVEs, zero-days with unknown scope or impact, KEVs, actively exploited vulnerabilities, and critical exposures. Correlate security and technology data, test hypotheses, identify affected assets, and continuously refine scope and impact as new information becomes available
• Incident Command: Lead fast-moving exposure events and serve as Incident Commander when appropriate. Make timely decisions with incomplete information, establish priorities, coordinate parallel workstreams, continuously track actions and decisions, and refine scope, impact, and response as the event evolves
• Response Coordination and Escalation: Coordinate across technology and security teams to establish ownership, drive remediation, resolve blockers, maintain momentum, and escalate conditions that threaten timely risk reduction. Engage SOC and Incident Response when findings indicate potential or active compromise
• Technical Leadership and Development: Provide hands-on coaching and training to develop analysts, strengthening capabilities in exposure investigation, threat hunting, investigative analysis, scope development, case management, escalation, and operational decision-making
• Operational Continuity: Maintain clear operational awareness and documentation of active events, including scope, findings, decisions, ownership, remediation status, blockers, and unresolved questions. Provide structured handoffs across coverage periods to maintain continuity and momentum

Requirements:

• 5+ years of cybersecurity or technology operations experience involving technical investigation, coordination, escalation, and resolution
• Demonstrated ability to lead or coordinate high-priority, fast-moving operational events and make sound decisions with incomplete or changing information
• Strong hands-on technical and investigative skills, with the ability to correlate multiple data sources, test assumptions, establish scope and impact, and determine required actions
• Ability to coordinate across technical teams without direct authority and drive issues toward resolution
• Experience mentoring, training, or providing technical guidance to developing analysts
• Experience in Security Operations, Incident Response, Threat Hunting, network operations, infrastructure operations, or another high-tempo technical operations environment
• Experience applying threat-hunting or incident-response investigative techniques to events where scope and impact evolved during the investigation
• Experience leading significant security or technical events, including Incident Command
• Familiarity with enterprise vulnerability, endpoint, cloud, asset, network, or exposure-management technologies
• Cyber Incident Response, Cyber Threat Analysis, Cyber Threat Hunting, Endpoint Security, Exposure Assessment, Exposure Management, Exposure Monitoring, Incident Response, Incident Response Operations, IT Security Operations, Security Incident Response, SOC Operations, Threat and Vulnerability Management, Threat Assessment, Threat Detection, Vulnerability Management