{"id":163864,"url":"https://alion.io/job/truist-cyber-incident-management-engineer","title":"Cyber Incident Management Engineer","company":{"id":5380,"name":"Truist","domain":"truist.com","url":"https://alion.io/company/truist","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":91,"open_postings":41,"ghost_share":0,"stale_share":0.512,"repost_share":0.049,"time_to_fill_p50_days":18,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Greensboro, United States","Atlanta, United States","Raleigh, United States","Charlotte, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":93000,"max_usd":180000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1306},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Incident Management","optional":false},{"name":"Agile","optional":true},{"name":"Copilot","optional":true},{"name":"ITIL","optional":true},{"name":"Power Apps","optional":true},{"name":"Power Automate","optional":true},{"name":"Scrum","optional":true},{"name":"SIEM","optional":true}],"status":"closed","first_seen_at":"2026-08-28T00:00:00Z","employer_posted_date":"2026-10-13","last_verified_at":"2026-10-21T13:39:08Z","board_verified":false,"closed_at":"2026-10-21T13:39:08Z","days_open":54,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":54},"description":"The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.\nNeed Help?\nIf you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).\nRegular or Temporary:\nRegularLanguage Fluency: English (Required)\nWork Shift:\n1st shift (United States of America)Please review the following job description:\nLeads enterprise cyber incident and high-risk vulnerability response efforts, coordinating cross-functional teams to assess, contain, and remediate threats. Designs and delivers automation solutions that improve Cyber Incident Management and cybersecurity program execution. Partners across security, technology, and business teams to enhance operational efficiency, accountability, reporting, and response outcomes.ESSENTIAL DUTIES AND RESPONSIBILITIES\nFollowing is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.\nAct as Incident Manager / Incident Coordinator for information security incidents, investigations, events, zero-days, and high-risk vulnerabilities. Drive end-to-end response from intake through containment, remediation, and closure. \nCoordinate cross-functional stakeholders during incidents and operational initiatives to drive alignment, accountability, and execution. \nDesign and implement automation solutions that improve Cyber Incident Management processes and operational efficiency. \nDevelop workflows that support incident intake, triage, escalation, stakeholder communications, action tracking, and closure. \nLeverage scripting, APIs, AI-enabled technologies, orchestration tools, and Microsoft 365 platforms to reduce manual effort and improve consistency. \nPartner with technical and business stakeholders to translate operational requirements into scalable automation and process improvements. \nManage cybersecurity automation projects and process improvement initiatives from planning through implementation. \nMaintain project plans, milestones, risks, issues, dependencies, action items, and executive updates. \nDevelop and maintain operational dashboards, metrics, scorecards, and leadership reporting to measure performance and identify improvement opportunities. \nAnalyze incidents, project, and operational data to support governance, decision making, and continuous improvement. \nQualifications\nRequired Qualifications\nThe requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.\n1. Bachelor’s degree in Computer Science, Information Systems, a related field, or equivalent education, training, and work-related experience.\n2. Minimum of 5 years of professional experience in information security.\n3. Strong knowledge of data security, privacy laws, regulatory compliance, and advanced security technologies.\n4. Experience in threat analysis, vulnerability testing, incident response, and forensic methodologies.\nPreferred Qualifications\nBachelor’s degree in Cybersecurity, Computer Science, Information Technology, Business, or a related field, or equivalent education and experience. \nExperience supporting cybersecurity operations, cyber incident management, major incident management, or related technology operations. \nExperience designing or supporting automation using scripting, APIs, workflow orchestration, artificial intelligence, or Microsoft 365 platforms. \nExperience coordinating cross-functional projects, operational initiatives, or process-improvement efforts. \nExperience gathering requirements, analyzing workflows, and translating business needs into technical or operational solutions. \nStrong organizational, analytical, facilitation, communication, and problem-solving skills. \nAbility to communicate effectively with technical and non-technical stakeholders at multiple organizational levels. \nExperience supporting a Cyber Incident Response Coordinator, Cyber Incident Management, Incident Command, or Major Incident Management function. \nExperience with Power Automate, Power Apps, SOAR platforms, Copilot, AI-enabled automation, or comparable workflow technologies. \nExperience integrating security technologies such as SIEM, SOAR, EDR, ticketing platforms, and APIs. \nExperience leading cybersecurity automation, process-improvement, or operational transformation initiatives. \nExperience developing dashboards, key performance indicators, operational metrics, and executive reporting. \nKnowledge of cybersecurity incident response, security operations, risk management, and governance practices. \nRelevant certifications such as CISSP, CISM, GCIH, PMP, CAPM, Scrum, Agile, ITIL, or equivalent. \nGeneral Description of Available Benefits for Eligible Employees of Truist Financial Corporation: All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truistoffers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist’s generous benefit plans, please visit our Benefits site. Depending on the position and division, this job may also be eligible for Truist’s defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work.\nTruist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace.\nEEO is the Law E-Verify IER Right to Work","description_format":"text","description_chars":6726,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["401k plan","Life insurance","Restricted stock units"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Wealth Management & Financial Advisors","Security Operations","Investment Banking & M&A Advisory"],"lifecycle":[{"event":"open","at":"2026-08-28T00:00:00Z"},{"event":"close","at":"2026-10-21T13:39:08Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/truist-cyber-incident-management-engineer","json_url":"https://alion.io/job/truist-cyber-incident-management-engineer.json","meta":{"generated_at":"2026-10-23T03:02:38Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5098,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5380},"rest":"https://alion.io/mcp/rest/get_company?id=5380"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftruist-cyber-incident-management-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftruist-cyber-incident-management-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftruist-cyber-incident-management-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/truist-cyber-incident-management-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftruist-cyber-incident-management-engineer"}]}