Sr Manager, Security Incident Response

Innovate in Charlotte
Thank you for dedicating your time and talent to Lowe's. We want to give you more opportunities to learn and grow, so if you find a position you're interested in below, we encourage you to apply!
Your Impact
The Sr Manager, Security Incident Response leads and coordinates the end-to-end management of cybersecurity incidents across the enterprise. The role serves as the central point of coordination during significant security events, bringing together Security Operations, Incident Response, Forensics, Threat Intelligence, Infrastructure, Cloud, Network, Application, Identity, Legal, Privacy, Communications, and business stakeholders.
The Sr Manager, Security Incident Response ensures that when a cybersecurity event occurs, the organization responds quickly, consistently, and decisively; minimizes business disruption and security exposure; maintains effective executive visibility; and converts lessons from incidents into measurable improvements in enterprise cyber resilience.
What You Will Do

• Lead the cybersecurity incident lifecycle from identification and triage through containment, eradication, recovery, closure, and post-incident review.
• Act as Incident Commander for high-severity and enterprise-impacting cybersecurity incidents; establish severity, business impact, escalation requirements, and response priorities.
• Coordinate SOC, Incident Response, Digital Forensics, Threat Intelligence, Offensive Security, Vulnerability.
• Management, Identity, Cloud, Network, Endpoint, Application Security, and infrastructure teams.
• Lead incident bridges and war rooms while maintaining clear ownership, action tracking, decision logs, timelines, and escalation paths.
• Translate complex technical findings into clear business and risk language for senior executives and provide timely executive-level situation reporting.
• Partner with Legal, Privacy, Compliance, Corporate Communications, HR, and business leadership when incidents have regulatory, privacy, employee, customer, or reputational implications.
• Ensure appropriate evidence preservation and forensic processes are followed throughout investigations.
• Drive root-cause analysis and post-incident reviews; track corrective actions and lessons learned through completion.
• Identify recurring incident patterns and recommend improvements to detection, response automation, security controls, processes, and technology.
• Develop and maintain incident response playbooks, escalation matrices, communication protocols, and crisis management procedures.
• Improved incident response maturity, preparedness, and collaboration across Security, Technology, and business organizations.
• Conduct tabletop exercises and cyber simulations covering ransomware, data breaches, compromised credentials, cloud incidents, insider threats, and supply-chain attacks.
• Define and track operational metrics such as MTTD, MTTA, MTTC, MTTR, incident volume, severity trends, recurrence rates, and response effectiveness.

Leadership

• The position requires strong technical understanding combined with exceptional incident leadership, communication, decision-making, and executive stakeholder management capabilities.
• Remains composed during critical incidents and establishes clarity when information is incomplete or rapidly changing.
• Influences teams without direct authority and creates alignment across technical, business, and executive stakeholders.
• Demonstrates ownership, accountability, collaboration, resilience, empathy, sound judgment, and executive presence.
• Adapts communication for technical responders, business leaders, and C-suite executives while maintaining a consistent view of incident risk and status.

Minimum Qualifications

• Bachelor's degree Computer Science, CIS, Engineering, Business Administration, Cybersecurity, or related field or equivalent years of experience in lieu of education requirement, if applicable.
• 8 years IT experience with a broad range of exposure to all aspects of business/system planning, analysis, and application development.
• 3 years experience leading project or technical teams with or without formal direct report responsibility; this includes experience providing technical direction, thought leadership, coaching and mentoring to team members.
• 4 years experience with information security tools, concepts and practices.
• Experience managing projects and project resources to meet goals on simultaneous/multiple projects.

Preferred Skills/Education
10+ years of cybersecurity or IT experience, with significant experience in Security Operations, Incident Response, Cyber Defense, Digital Forensics, or related disciplines.
Demonstrated experience managing major security incidents in complex enterprise environments.
Strong knowledge of SIEM/SOAR, EDR/XDR, network security, cloud security, identity and access management, threat intelligence, ransomware response, vulnerability management, and forensic investigation.
Strong leadership under pressure, structured problem-solving, stakeholder management, conflict resolution, and executive communication skills.
Ability to coordinate multiple technical and business teams while balancing containment decisions with operational and business impact.
About Lowe's
Lowe's Companies, Inc. (NYSE: LOW) is a FORTUNE® 100 home improvement company with total fiscal year 2025 sales of more than $86 billion. Lowe's employs approximately 300,000 associates and operates over 1,750 home improvement stores, 540 branches and 120 distribution centers. Lowe's is a core value S&P 500 equity stock and a dividend aristocrat. Based in Mooresville, N.C., Lowe's supports the communities it serves through programs focused on creating safe, affordable housing, improving community spaces, helping to develop the next generation of skilled trade experts and providing disaster relief to communities in need. For more information, visit Lowes.com .
Lowe's is an equal opportunity employer and administers all personnel practices without regard to race, color, religious creed, sex, gender, age, ancestry, national origin, mental or physical disability or medical condition, sexual orientation, gender identity or expression, marital status, military or veteran status, genetic information, or any other category protected under federal, state, or local law.