{"id":3940447,"url":"https://alion.io/job/lowes-sr-manager-security-incident-response","title":"Sr Manager, Security Incident Response","company":{"id":1753694,"name":"Lowe's","domain":"lowes.com","url":"https://alion.io/company/lowes-com","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":100,"open_postings":4,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":4,"computed_at":"2026-11-08T05:47:12Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Charlotte, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"SIEM","optional":true}],"status":"live","first_seen_at":"2026-11-06T00:00:00Z","employer_posted_date":"2026-11-06","last_verified_at":"2026-11-08T20:54:10Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"Innovate in Charlotte\nThank you for dedicating your time and talent to Lowe’s. We want to give you more opportunities to learn and grow, so if you find a position you’re interested in below, we encourage you to apply!\nYour Impact\nThe Sr Manager, Security Incident Response leads and coordinates the end-to-end management of cybersecurity incidents across the enterprise. The role serves as the central point of coordination during significant security events, bringing together Security Operations, Incident Response, Forensics, Threat Intelligence, Infrastructure, Cloud, Network, Application, Identity, Legal, Privacy, Communications, and business stakeholders.\nThe Sr Manager, Security Incident Response ensures that when a cybersecurity event occurs, the organization responds quickly, consistently, and decisively; minimizes business disruption and security exposure; maintains effective executive visibility; and converts lessons from incidents into measurable improvements in enterprise cyber resilience.\nWhat You Will Do\nLead the cybersecurity incident lifecycle from identification and triage through containment, eradication, recovery, closure, and post-incident review.\nAct as Incident Commander for high-severity and enterprise-impacting cybersecurity incidents; establish severity, business impact, escalation requirements, and response priorities.\nCoordinate SOC, Incident Response, Digital Forensics, Threat Intelligence, Offensive Security, Vulnerability.\nManagement, Identity, Cloud, Network, Endpoint, Application Security, and infrastructure teams.\nLead incident bridges and war rooms while maintaining clear ownership, action tracking, decision logs, timelines, and escalation paths.\nTranslate complex technical findings into clear business and risk language for senior executives and provide timely executive-level situation reporting.\nPartner with Legal, Privacy, Compliance, Corporate Communications, HR, and business leadership when incidents have regulatory, privacy, employee, customer, or reputational implications.\nEnsure appropriate evidence preservation and forensic processes are followed throughout investigations.\nDrive root-cause analysis and post-incident reviews; track corrective actions and lessons learned through completion.\nIdentify recurring incident patterns and recommend improvements to detection, response automation, security controls, processes, and technology.\nDevelop and maintain incident response playbooks, escalation matrices, communication protocols, and crisis management procedures.\nImproved incident response maturity, preparedness, and collaboration across Security, Technology, and business organizations.\nConduct tabletop exercises and cyber simulations covering ransomware, data breaches, compromised credentials, cloud incidents, insider threats, and supply-chain attacks.\nDefine and track operational metrics such as MTTD, MTTA, MTTC, MTTR, incident volume, severity trends, recurrence rates, and response effectiveness.\nLeadership\nThe position requires strong technical understanding combined with exceptional incident leadership, communication, decision-making, and executive stakeholder management capabilities.\nRemains composed during critical incidents and establishes clarity when information is incomplete or rapidly changing.\nInfluences teams without direct authority and creates alignment across technical, business, and executive stakeholders.\nDemonstrates ownership, accountability, collaboration, resilience, empathy, sound judgment, and executive presence.\nAdapts communication for technical responders, business leaders, and C-suite executives while maintaining a consistent view of incident risk and status.\nMinimum Qualifications\nBachelor’s degree Computer Science, CIS, Engineering, Business Administration, Cybersecurity, or related field or equivalent years of experience in lieu of education requirement, if applicable.\n8 years IT experience with a broad range of exposure to all aspects of business/system planning, analysis, and application development.\n3 years experience leading project or technical teams with or without formal direct report responsibility; this includes experience providing technical direction, thought leadership, coaching and mentoring to team members.\n4 years experience with information security tools, concepts and practices.\nExperience managing projects and project resources to meet goals on simultaneous/multiple projects.\nPreferred Skills/Education\n10+ years of cybersecurity or IT experience, with significant experience in Security Operations, Incident Response, Cyber Defense, Digital Forensics, or related disciplines.\nDemonstrated experience managing major security incidents in complex enterprise environments.\nStrong knowledge of SIEM/SOAR, EDR/XDR, network security, cloud security, identity and access management, threat intelligence, ransomware response, vulnerability management, and forensic investigation.\nStrong leadership under pressure, structured problem-solving, stakeholder management, conflict resolution, and executive communication skills.\nAbility to coordinate multiple technical and business teams while balancing containment decisions with operational and business impact.\nAbout Lowe’s\nLowe’s Companies, Inc. (NYSE: LOW) is a FORTUNE® 100 home improvement company with total fiscal year 2025 sales of more than $86 billion. Lowe’s employs approximately 300,000 associates and operates over 1,750 home improvement stores, 540 branches and 120 distribution centers. Lowe’s is a core value S&P 500 equity stock and a dividend aristocrat. Based in Mooresville, N.C., Lowe’s supports the communities it serves through programs focused on creating safe, affordable housing, improving community spaces, helping to develop the next generation of skilled trade experts and providing disaster relief to communities in need. For more information, visit Lowes.com.\nLowe’s is an equal opportunity employer and administers all personnel practices without regard to race, color, religious creed, sex, gender, age, ancestry, national origin, mental or physical disability or medical condition, sexual orientation, gender identity or expression, marital status, military or veteran status, genetic information, or any other category protected under federal, state, or local law.","description_format":"text","description_chars":6303,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Information Security","Tools & DIY Supplies","Kitchens, Bathrooms & Home Improvement"],"lifecycle":[{"event":"open","at":"2026-11-08T14:00:42Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.837,"p_room":0.75,"age_days":2,"expected_fill_days":4,"reasons":["conf:0","win:late","comp:brand"],"computed_at":"2026-11-08T21:46:47Z"},"pay":null,"html_url":"https://alion.io/job/lowes-sr-manager-security-incident-response","json_url":"https://alion.io/job/lowes-sr-manager-security-incident-response.json","meta":{"generated_at":"2026-11-08T21:46:47Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":45462,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-09T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1753694},"rest":"https://alion.io/mcp/rest/get_company?id=1753694"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flowes-sr-manager-security-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flowes-sr-manager-security-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flowes-sr-manager-security-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/lowes-sr-manager-security-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flowes-sr-manager-security-incident-response"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3940447}},{"tool":"search_jobs","arguments":{"company":"lowes.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3940447},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}