Cyber Defense Incident Response Lead

Location: 4910 Tiedeman Road, Brooklyn Ohio Job Description   Cyber Incident Response Lead   As a member of the Cyber Defense team within Corporate Information Security, the Incident Response Lead plays a critical role in strengthening KeyBank’s ability to prepare for, coordinate, and respond to cybersecurity incidents across the enterprise. This position is responsible for leading high-impact cyber incident response activities, ensuring timely coordination across Cyber Defense, technology, business, risk, legal, communications, and executive stakeholders. The Incident Response Lead will own and continuously mature the Cyber Defense incident response program by maintaining response documentation, improving playbooks and runbooks, developing repeatable response processes, and ensuring lessons learned are translated into actionable program improvements.   This role requires a strong blend of cyber incident response experience, program development capability, executive communication skills, and operational leadership. The Incident Response Lead will facilitate tabletop exercises, support incident simulations, drive post-incident reviews, develop executive-level reporting, and help ensure KeyBank’s incident response capabilities remain aligned to the evolving threat landscape, regulatory expectations, and business resilience needs. This position directly supports KeyBank’s mission to Deter, Detect, Deny, and Disrupt adversaries through coordinated, well-documented, and continuously improving cyber defense capabilities.   Key Responsibilities   Incident Leadership: Lead cybersecurity incident response coordination for significant cyber events, ensuring appropriate triage, escalation, containment coordination, stakeholder engagement, and resolution tracking.   Incident Command & Coordination: Serve as a primary Cyber Defense incident response lead during active incidents, coordinating across Cyber Threat Response, Cyber Threat Management, Cyber Detection and Automation, Cyber Application and Cloud Defense, Cyber Adversary and Exposure Management, Technology Incident Management, Corporate Incident Response, and other enterprise partners as needed.   Documentation & Case Management: Ensure accurate, timely, and complete documentation of incident timelines, actions taken, decisions made, evidence collected, communications issued, and lessons learned.   Program Development: Develop, mature, and maintain the Cyber Defense incident response program, including response frameworks, operating models, escalation paths, governance routines, templates, metrics, and continuous improvement processes.   Playbook & Runbook Management: Create, update, and maintain incident response playbooks, runbooks, quick reference guides, and standard operating procedures to support consistent execution during cyber events.   Tabletop Exercises: Design, facilitate, and evaluate cyber tabletop exercises, simulations, and scenario-based discussions to test readiness, validate response plans, identify gaps, and drive remediation actions.   Post-Incident Reviews: Lead post-incident reviews and lessons- learned sessions, documenting root cause, response effectiveness, improvement opportunities, and ownership of follow-up actions.   Executive Reporting: Develop clear, concise, and business-relevant incident reporting for Cyber Defense leadership, CIS leadership, executive stakeholders, committees, and board-level audiences as appropriate.   Metrics & Continuous Improvement: Establish and track incident response performance metrics, including response timelines, documentation quality, action closure, recurring themes, exercise findings, and program maturity indicators.   Stakeholder Engagement: Partner with business, technology, risk, legal, compliance, communications, and third-party teams to ensure Cyber Defense response processes are understood, practiced, and integrated with enterprise incident management expectations.   Regulatory & Audit Support: Support internal audit, regulatory, and compliance requests related to cybersecurity incident response documentation, testing, governance, and program effectiveness.   Threat-Informed Readiness: Collaborate with Threat Intelligence, Detection Engineering, SOC operations, and other Cyber Defense teams to ensure response plans reflect current adversary tactics, emerging threats, and relevant attack scenarios.   Crisis Communication Support: Support the development of leadership updates, incident summaries, situation reports, after-action reports, and communication artifacts during and after cyber events.   Process Automation & AI Enablement: Identify opportunities to improve incident response efficiency through automation, AI-enabled workflows, structured data capture, and repeatable response templates.   Knowledge Sharing: Provide training, coaching, and knowledge transfer to Cyber Defense team members and cross-functional partners on incident response expectations, playbook usage, tabletop outcomes, and program changes.   Required Qualifications   Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Business Continuity, Risk Management, or related field — or equivalent practical experience.   8+ years of experience in cybersecurity, incident response, security operations, cyber risk management, technology incident management, or related disciplines.   Demonstrated experience leading or coordinating cybersecurity incidents in complex enterprise environments.   Strong understanding of incident response lifecycle activities, including preparation, detection, analysis, containment, eradication, recovery, and post-incident improvement.   Experience developing or maintaining incident response plans, playbooks, runbooks, procedures, executive summaries, or after-action reports.   Ability to lead cross-functional teams during high-pressure situations and drive clarity, accountability, and timely decision-makin