Manager, Cyber Incident Response

NBCUniversal’s Cyber Defense Operations team provides cyber threat intelligence, event monitoring, incident response, and threat hunting across the enterprise in a highly collaborative, fast-paced, and agile environment. Cyber Response Operations serves as NBCUniversal’s 24x7 first line of defense against cyber threats. Event Analysts and Incident Responders follow the Incident Response Plan to identify, assess, contain, remediate, and document cyber events and incidents. The Manager of Cyber Incident Response leads the Incident Response team while guiding and supporting the Event Analyst function. The role oversees escalations involving containment, remediation, forensic analysis, and coordination with impacted businesses and partner teams. This leader establishes the operating rigor needed for consistent performance while enabling responders to exercise sound judgment, creativity, and ownership. The Manager is accountable for team readiness, workflow prioritization, escalation quality, process maturity, and employee development. The role requires regular engagement with business stakeholders, Information Security Officers, technical teams, vendors, and senior leadership during both routine operations and active incidents. Duties and Responsibilities Manage Incident Response operations, including prioritization, resource allocation, shift coverage, tooling requirements, workflow management, and escalation processes. Ensure the NBCUniversal Incident Response Plan and supporting procedures are implemented and followed in day-to-day operations. Oversee and manage cyber incidents across the NBCUniversal enterprise, from escalation and validation through containment, remediation, recovery support, and closure. Serve as an Incident Handler or Incident Commander for significant incidents, coordinating response activities with impacted businesses, technical owners, and partner teams. Act as the managerial escalation point for potential cyber incidents, responder support needs, and decisions requiring leadership awareness or approval. Participate in the manager on-call rotation for cyber incident escalation and handling in a 24x7x365 global environment. Supervise operational performance across shifts, ensuring consistent prioritization, ticket ownership, escalation discipline, and adherence to company standards. Review shift handovers, queue health, and open incidents to ensure continuity, clear accountability, and timely follow-through across operating periods. Maintain and enforce event and incident documentation standards, case-management requirements, key performance indicators, and process adherence. Monitor operational metrics and trends, identify gaps, and implement improvements that strengthen effectiveness, risk reduction, and business impact. Lead the review and governance of response processes, playbooks, tuning requests, automation opportunities, and technical procedures. Drive the maturity, enhancement, and strategy of the Incident Response program in alignment with business and enterprise priorities. Act as a strategic partner to Information Security Officers, business stakeholders, and other security and technology teams. Develop and maintain process documentation, including clear ownership, review cycles, approval requirements, and change management. Lead, coach, and develop Incident Response personnel, providing regular feedback and supporting technical, professional, and career growth. Create and deliver monthly metrics and executive reporting that communicate operational effectiveness, risk reduction, material trends, and business impact. Communicate incident status, operational concerns, decisions, and risk clearly to business VIPs and senior leadership.