{"id":2994033,"url":"https://alion.io/job/lowes-lead-analyst-security-operations-incident-response","title":"Lead Analyst – Security Operations Incident Response","company":{"id":1753694,"name":"Lowe's","domain":"lowes.com","url":"https://alion.io/company/lowes-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Charlotte, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":74000,"max_usd":153000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":398},"experience_years_min":7,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"Incident Management","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Outlook","optional":false},{"name":"SIEM","optional":false}],"status":"live","first_seen_at":"2026-10-12T00:00:00Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-23T23:09:02Z","board_verified":true,"closed_at":null,"days_open":12,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":12},"description":"Innovate in Charlotte\nThank you for dedicating your time and talent to Lowe’s. We want to give you more opportunities to learn and grow, so if you find a position you’re interested in below, we encourage you to apply!\nAs the Lead Analyst - Security Operations Incident Response, you’ll operate as a lead cybersecurity incident commander and trusted partner to senior executives, translating complex, rapidly evolving threats into clear business impact, risk, response priorities, and decisions while providing the leadership and coordination needed to move the organization forward.\nBeyond managing today’s incidents, you’ll also have the opportunity to shape the future of enterprise incident response, advancing how automation, Generative AI, and agentic AI can accelerate investigations, strengthen decision-making, and build a faster, smarter, and more resilient security operation at enterprise scale.\nKey Responsibilities\nLead and coordinate response to high-severity cybersecurity incidents, including ransomware, account compromise, data exposure, cloud incidents, malware, insider threats, and third-party or supply-chain events. \nOwn the security incident management lifecycle from identification, triage, containment, eradication, and recovery through post-incident review. \nEstablish incident severity, business impact, escalation paths, response priorities, and appropriate stakeholder engagement. \nAct as the Incident Commander for major cybersecurity incidents and coordinate technical and business response teams. \nMaintain clear timelines, decision logs, action items, evidence, and incident documentation throughout an event. \nProvide concise, timely executive-level incident reporting and briefings to senior leadership, including business impact and risk, incident severity and scope, response and containment status, key decisions or support required, recovery outlook, and material changes throughout the incident lifecycle. \nCoordinate with Legal, Privacy, Risk, HR, Communications, and other teams when incidents have regulatory, customer, associate, or reputational implications. \nFacilitate incident war rooms and bridge calls and maintain disciplined command-and-control practices. \nEnsure appropriate handoffs between SOC analysts, threat hunters, DFIR, engineering, infrastructure, identity, cloud, and application teams. \nLead post-incident reviews and root-cause discussions and track corrective actions through closure. Deliver executive post-incident summaries covering root cause, business impact, lessons learned, residual risk, remediation priorities, and accountable action owners. \nIdentify recurring incident patterns and recommend improvements to security controls, detection capabilities, processes, and automation. \nDevelop and maintain incident response plans, playbooks, escalation matrices, communication templates, and tabletop exercises. \nTrack operational metrics such as MTTD, MTTA, MTTC, MTTR, incident severity, recurrence, SLA adherence, and corrective-action closure. \nSupport regulatory, audit, cyber insurance, and compliance requirements related to incident response. \nDrive continuous improvement through automation, orchestration, AI-enabled investigation, and incident enrichment where appropriate. \nRequired Qualifications\n7-10+ years of experience in cybersecurity, with significant experience in Security Operations, Incident Response, DFIR, Threat Management, or Cyber Crisis Management. \nStrong understanding of SIEM, SOAR, EDR/XDR, IAM, network security, cloud security, threat intelligence, and vulnerability management. \nExperience managing high-severity, enterprise-scale security incidents involving multiple technical and business teams. \nStrong knowledge of incident response frameworks such as NIST, SANS, and MITRE ATT&CK. \nWorking knowledge of cloud environments such as AWS, Azure, or GCP. \nExcellent crisis leadership, stakeholder management, decision-making, and communication skills. \nAbility to translate complex technical findings into clear business risk and executive-level communications. \nStrong documentation, analytical, and problem-solving capabilities. \nAbility to operate effectively under pressure and manage multiple priorities during critical incidents. \nPreferred Certifications\nCISSP, GCIH, GCFA, GCFE, CISM, Security+, or equivalent incident response/security certifications. \nKey Success Measures\nSuccess in this role would typically be demonstrated through reduced incident response and recovery times, consistent execution of major-incident procedures, effective executive communication, high-quality post-incident reviews, timely closure of remediation actions, improved incident readiness, and measurable reduction in repeat incidents. \nKey Partners\nSecurity Engineering, SOC, DFIR, Threat Intelligence, Threat Hunting, IAM, Cloud Security, Application Security, Infrastructure, Legal, Privacy, Risk, HR, and Corporate Communications. \nEnterprise / Retail Environment Considerations\nFor a large retail enterprise environment, the role should emphasize 24x7 incident coordination, third-party and supply-chain incidents, payment and e-commerce environments, customer data protection, cloud incidents, and executive crisis management. \nAbout Lowe’s\nLowe’s Companies, Inc. (NYSE: LOW) is a FORTUNE® 100 home improvement company with total fiscal year 2025 sales of more than $86 billion. Lowe’s employs approximately 300,000 associates and operates over 1,750 home improvement stores, 540 branches and 120 distribution centers. Lowe’s is a core value S&P 500 equity stock and a dividend aristocrat. Based in Mooresville, N.C., Lowe’s supports the communities it serves through programs focused on creating safe, affordable housing, improving community spaces, helping to develop the next generation of skilled trade experts and providing disaster relief to communities in need. For more information, visit Lowes.com.\nLowe’s is an equal opportunity employer and administers all personnel practices without regard to race, color, religious creed, sex, gender, age, ancestry, national origin, mental or physical disability or medical condition, sexual orientation, gender identity or expression, marital status, military or veteran status, genetic information, or any other category protected under federal, state, or local law.","description_format":"text","description_chars":6322,"description_truncated":false,"requirements":{"experience_years_min":7,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Retail & Shop Systems","Tools & DIY Supplies","Kitchens, Bathrooms & Home Improvement"],"lifecycle":[{"event":"open","at":"2026-10-21T10:38:50Z"}],"visa":[],"liveness":{"score":23,"band":"cold","label":"Long shot","p_open":1,"p_active":0.656,"p_room":0.35,"age_days":11,"expected_fill_days":5,"reasons":["conf:0","velocity","win:tail","comp:brand"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/lowes-lead-analyst-security-operations-incident-response","json_url":"https://alion.io/job/lowes-lead-analyst-security-operations-incident-response.json","meta":{"generated_at":"2026-10-24T00:58:44Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1575,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-25T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1753694},"rest":"https://alion.io/mcp/rest/get_company?id=1753694"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flowes-lead-analyst-security-operations-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flowes-lead-analyst-security-operations-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flowes-lead-analyst-security-operations-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/lowes-lead-analyst-security-operations-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flowes-lead-analyst-security-operations-incident-response"}]}