Lead Cyber Incident Commander; Hybrid

Position: Lead Cyber Incident Commander (Hybrid)
Join American Family Insurance in Boston, MA as our Lead Cyber Incident Commander to spearhead our response to major cybersecurity events. In this critical leadership role, you'll direct disciplined, coordinated actions that protect our operations, customers, and reputation.
You'll lead high-impact incidents with authority—driving swift action, uniting stakeholders, and ensuring clear communication from the front lines to the boardroom. From detection to recovery, you'll own the incident lifecycle, mitigating risks and strengthening our resilience.
We're looking for an experienced leader with a track record managing complex incidents in large organizations and deep expertise in incident response frameworks. This is your chance to shape the future of cybersecurity at American Family Insurance.
You will report to the Senior Manager, Cybersecurity.
Relocation to Boston may be provided based on the needs of the company.
#LI-Hybrid

Position Compensation Range:

$ - $

Pay Rate Type:

Salary

Compensation may vary based on the job level and your geographic work location. Relocation support is offered for eligible candidates.

Primary Accountabilities:

• Lead and coordinate all phases of critical cybersecurity incident response—detection, triage, containment, eradication, and recovery.
• Serve as the primary escalation point, ensuring clear communication among technical teams, executives, and business stakeholders.
• Facilitate incident bridges, manage war rooms, and document actions in real time.
• Oversee incident classification, prioritization, and escalation per established policies.
• Collaborate with IT, Legal, Compliance, Communications, and other teams for unified response.
• Deliver incident status updates and executive summaries to senior leadership.
• Conduct post-incident reviews, root cause analysis, and drive remediation and process improvements.
• Maintain and enhance incident response playbooks, runbooks, and communication templates.
• Mentor and train responders and stakeholders on best practices.
• Stay current on emerging threats, attack techniques, and regulatory requirements.

Specialized Knowledge & Skills Requirements

• Demonstrated experience providing customer-driven solutions, support or service.
• Solid knowledge and understanding of software engineering architectures, system/software designs, and system deployments.
• Working knowledge and of Cyber Security, Cyber Engineering, Computer Science, Software Engineering, Electrical / Computer Engineering.
• Extensive knowledge and understanding of security technologies and application development methodologies.
• Demonstrated experience performing cyber threat analysis, incident response, forensics analysis, penetration testing, and ethical hacking.
• Extensive knowledge and understanding of directory services and identity stores.

Preferred Qualifications

• Experience directing high-impact cyber incident response efforts in large enterprise (1000+).
• 7–10+ years of progressive experience in cybersecurity, with at least 5 years in incident response or security operations leadership roles.
• Demonstrated ability to communicate complex technical information clearly to executives, business stakeholders, and technical teams.
• Experience leading after-action reviews, and continuous improvement programs.
• Knowledge of incident management frameworks and methodologies (NIST 800-61, ISO 27035, SANS).
• Hands-on expertise with SIEM, EDR/XDR, threat intelligence, and forensic tools.
• Industry-recognized certifications include CISSP, CISM, GCIH, GCIM, GCFA, or equivalent.
• Familiarity with compliance and regulatory obligations (e.g., GDPR, HIPAA, PCI-DSS, SOX).
• Collaborating effectively with cross-functional stakeholders, third-party vendors, and government or law enforcement agencies.
• Bachelor's or master's degree in Cybersecurity, Computer Science, Information Technology, or a related field.

Additional Information

• Offer to selected candidate will be made contingent on the results of applicable background checks

• Offer to selected candidate is contingent on signing a non-disclosure agreement for proprietary information, trade secrets, and inventions

• Sponsorship will not be considered for this position unless specified in the…