Incident Response Manager
About the role
Huron is redefining what a global consulting organization can be. Advancing new ideas every day to build even stronger clients, individuals and communities. We’re helping our clients find new ways to drive growth, enhance business performance and sustain leadership in the markets they serve. And, we’re developing strategies and implementing solutions that enable the transformative change they need to own their future.
As a member of the Huron corporate team, you’ll help to evolve our business model to stay ahead of market forces, industry trends and client needs. Our accounting, finance, human resources, IT, legal, marketing and facilities management professionals work collaboratively to support Huron’s collective strategies and enable real transformation to produce sustainable business results.
Join our team and create your future.
Key Responsibilities
Incident coordination and investigation
- Serve as the central coordinator for security and data incidents, driving investigations from initial detection through resolution and closure.
- Partner with investigators, forensics resources, IT, DLP, Legal, HR, and business stakeholders to keep active incidents moving and unblocked.
- Coordinate the response to breaches, DLP events, privacy incidents, fraud and identity matters, unauthorized access, workforce activity concerns, and data exposure events.
- Support timely triage and severity assessment, ensuring the right people are engaged at the right time.
Stakeholder management and communication
- Act as a trusted point of contact for stakeholders across Legal, HR, Global Security, IT, and the business during active incidents.
- Prepare and deliver clear, timely status updates and executive-level briefings for leadership.
- Coordinate cross-functional communication so investigators, decision-makers, and affected business units stay aligned without duplicated or conflicting messaging.
- Provide flexibility to support incidents off-hours as needed, given the time-sensitive nature of the work.
Tracking, process, and reporting
- Own the incident tracking system, ensuring every action item, remediation step, and follow-up is assigned, tracked, and driven to closure.
- Maintain and continuously refine incident response playbooks, processes, and procedures.
- Produce regular incident metrics and reporting, giving leadership an accurate, executive-level view of open, closed, and trending incidents.
- Support post-incident reviews and lessons-learned sessions, feeding improvements back into process and playbooks.
Program scope and cross-functional collaboration
- Collaborate with the DLP, GRC, and BCP functions to ensure incident response integrates cleanly with adjacent security and continuity programs.
- Support integration of incident response scenarios into business continuity and ransomware tabletop exercises.
- Help ensure incidents are handled in a manner consistent with regulatory, privacy, and compliance obligations, in partnership with Legal and Compliance.
- Identify and close gaps in incident response coordination, escalation paths, and stakeholder communication.
Qualifications
- 5+ years of experience in incident response, security operations, GRC, or a related security coordination role, preferably in a large company or consulting firm.
- Demonstrated experience coordinating investigations or incidents involving multiple stakeholders and teams.
- Undergraduate degree required, preferably in Information Security, Information Technology, Information Systems, or a related discipline.
- Working knowledge of incident response frameworks and practices, and of the security domains that generate incidents most often (DLP, identity and access, privacy, fraud).
- Excellent written and verbal communication skills, with the ability to brief both technical and executive audiences clearly and calmly.
- Strong organizational skills, with the ability to track many concurrent action items across multiple open incidents without losing detail.
- Ability to remain composed and effective under pressure, including flexibility to support incidents outside standard business hours.
Preferred Skills
- Security certifications such as GCIH, GCFA, CISM, CISSP, or similar.
- Experience with case management or incident tracking tools (e.g., ServiceNow, Jira, ADO).
- Familiarity with DLP, identity and access management, and privacy or fraud investigation practices.
- Experience producing metrics and reporting for senior leadership audiences.
- Analytical problem-solving skills, including the ability to synthesize incident data into a format that supports leadership decision-making.
- Experience working across time zones and with distributed, cross-functional teams.
The estimated base salary for this job is $140,000 - $190,000. The actual salary paid to an individual will vary based on multiple factors, including but not limited to specific skills or certifications, years of experience, market changes, and required travel. This job is also eligible to participate in Huron’s annual incentive compensation program, which reflects Huron’s pay for performance philosophy. Inclusive of annual incentive compensation opportunity, the total estimated compensation range for this job is $168,000 - $228,000. The job is also eligible to participate in Huron’s benefit plans which include medical, dental and vision coverage and other wellness programs.