Apply today for consideration!Title: Security Incident ManagerLocation: Remote Pay rate: $42.00 - 45/hour DOEDuration: 12+Months (Possibility of extension) Duties- Serve as the primary coordinator for major cybersecurity, trust & safety, and fraud incidents: organizing tasks, tracking progress, and maintaining clear communication across all involved teams and stakeholders in ServiceNow Security Incident Response (SIR).
- Coordinate the full incident lifecycle: containment, eradication, recovery, and closure, ensuring containment is validated against client control-testing standard before an incident is marked resolved.
- Develop, maintain, and enforce incident response playbooks and protocols in partnership with SOC capability champs across Insider Risk, Escalations, and DFIR, ensuring consistency without duplicating existing ownership.
- Produce regular incident reporting, from operational status updates to board/SLT-level summaries, with clear actions taken, outcomes, and recommendations for improvement.
- Run the lessons-learned loop: facilitate post-incident hot washes, convert findings into documented action items, and drive report/playbook updates on a regular cadence rather than ad hoc.
- Provide clear, comprehensive documentation and updates to relevant internal partners, including IT, Legal, Compliance, and Customer Support.
- Support onboarding and training for team members on incident response protocols and tooling, reinforcing adherence to established SOC processes.
- Stay current on incident response and fraud/trust & safety best practices, adapting SOC processes as threats and requirements evolve.
Skills:- Demonstrated ability to manage multiple concurrent incidents, tasks, and stakeholders in a high-pressure environment while maintaining accuracy and composure.
- Solid working knowledge of incident response procedures across cybersecurity, trust & safety, and fraud contexts.
- Excellent organizational, written, and verbal communication skills; able to translate technical detail for non-technical audiences and vice versa.
- Experience with ServiceNow Security Incident Response (SIR) or a comparable ITSM/SIR platform strongly preferred.
- Comfort working across Insider Risk, Escalations, and DFIR functions without owning their technical domains directly.
Education RequiredBachelor’s degree in an IT-related or Engineering field. Education Preferred Bachelor’s degree in an IT-related or Engineering field. Additional Information Work is expected to be done on 100% Remote. Russell Tobin offers eligible employees comprehensive healthcare coverage (medical, dental, and vision plans), supplemental coverage (accident insurance, critical illness insurance and hospital indemnity), a 401(k)-retirement savings, life & disability insurance, an employee assistance program, identity theft protection, legal support, auto and home insurance, pet insurance, and employee discounts with some preferred vendors.
Equal Employment Opportunity
Russell Tobin is an equal opportunity employer. We do not discriminate on the basis of the race, religious creed, color, national origin, ancestry, physical disability, mental disability, reproductive health decision making, medical condition, genetic information, marital status, sex, gender, gender identity, gender expression, age, sexual orientation, veteran or military status, or any other characteristic protected by applicable federal, state, or local law.
Fair Chance Employment
Russell Tobin is a Fair Chance employer. We consider all qualified applicants, including those with criminal histories, in a manner consistent with applicable state and local Fair Chance laws and ordinances, including, the California Fair Chance Act and all applicable local Fair Chance ordinances.
Accommodations
We are committed to providing reasonable accommodations to applicants and employees with disabilities. If you require a reasonable accommodation to participate in the application or interview process, or to perform the essential functions of this role, please contact us.
Only applicable for San Francisco Candidates: Under the San Francisco Lactation in the Workplace Ordinance, we will provide written notice of lactation accommodation rights, and this notice will automatically be given upon hiring, any inquiry of parental leave or lactation accommodation.
#LI-RS3#RTA#RTA-ZR 
Never miss an opportunity! Create an alert based on the job you applied for.
