Senior Incident Response Readiness Analyst

The Senior Incident Response Readiness Analyst is a senior individual contributor responsible for strengthening the organization’s ability to prepare for, respond to, and recover from cyber, technology, and operational disruptions. This role focuses on incident response planning, playbook development, Product Owner and business stakeholder advisory support, readiness exercises, training, awareness, and continuous improvement. The position partners with technology, product, business, crisis management, communications, legal, cybersecurity, infrastructure, and business continuity stakeholders to create and validate response plans, maintain BCDR and incident response artifacts, coordinate readiness activities, assess response and recovery capabilities, report program health, and drive remediation of identified gaps. Through this work, the Senior Incident Response Readiness Analyst helps ensure that critical services, applications, business capabilities, response teams, and third-party dependencies are prepared to execute coordinated, timely, and effective response and recovery activities in alignment with enterprise resiliency standards and business impact expectations. 

•    Maintain and update BCDR and incident response readiness artifacts, including BIAs, recovery plans, runbooks, incident response plans, playbooks, RTO/RPO targets, escalation paths, response owner rosters, and dependency mappings.
•    Develop, maintain, validate, and improve incident response plans and playbooks for critical products, applications, services, business capabilities, and supporting technology environments.
•    Advise Product Owners and business stakeholders on response roles, decision points, escalation criteria, communications expectations, recovery dependencies, plan ownership, maintenance responsibilities, and readiness requirements.
•    Serve as an incident response coordinator during cyber, technology, or operational incidents by supporting playbook activation, war room coordination, containment and triage task tracking, action documentation, timeline management, stakeholder updates, and post-incident review activities.
•    Plan, design, and execute incident response readiness activities such as tabletop exercises, simulation drills, playbook walkthroughs, service failovers, and recovery rehearsals; define objectives, scenarios, success criteria, and evidence expectations.
•    Author and maintain incident response materials, exercise materials, response checklists, evidence capture templates, communication guidance, lessons-learned reports, maturity updates, and remediation tracking artifacts.
•    Liaise with application, service, product, infrastructure, cybersecurity, business continuity, and business owners to validate response procedures, recovery procedures, escalation contacts, acceptance criteria, and response ownership.
•    Coordinate with Crisis Management, Communications, Legal, cybersecurity, infrastructure, business continuity, and executive stakeholders to ensure integrated response, escalation, stakeholder briefing, and recovery planning alignment.
•    Manage third-party continuity and incident response dependencies by integrating vendor roles, escalation contacts, contractual expectations, service restoration assumptions, and recovery dependencies into plans, playbooks, and exercises.
•    Measure and report incident response readiness program health, including plan coverage, playbook quality, exercise results, incident lifecycle metrics, time-to-coordinate containment or initial recovery actions, stakeholder readiness, training completion, and remediation closure.
•    Train and onboard incident responders, Product Owners, business stakeholders, recovery participants, and support teams; deliver awareness sessions and readiness guidance to build organizational maturity in incident response planning and execution.

Basic (required) Qualifications:
•    Bachelor’s degree from an accredited institution 
•    Minimum of five (5) years of experience in in incident response readiness, cyber incident response, business continuity, disaster recovery, cyber resilience, crisis management, technology risk, IT operations, cybersecurity operations, or an equivalent combination.
•    Strong understanding of the incident response lifecycle, including preparation, detection support, triage coordination, escalation, containment coordination, recovery support, stakeholder communications, post-incident review, and continuous improvement.
•    Must be legally authorized to work in the US without company sponsorship No relocation is offered for this position. All candidates must currently reside within 50 miles of Beachwood, OH, Galesburg MI, Houston TX, Menomonee Falls WI, Moon Township PA, or Raleigh NC to be considered.  
•    Must be authorized to work in the United States without company sponsorship now or in the future

Preferred Qualifications:
•    Experience developing, maintaining, and improving incident response plans, playbooks, runbooks, escalation paths, response checklists, evidence capture templates, communication guidance, and lessons-learned documentation.
•    Demonstrated ability to advise Product Owners, business stakeholders, application teams, infrastructure teams, and recovery owners on incident response readiness expectations, plan ownership, response roles, decision points, communications, recovery dependencies, and maintenance requirements.
•    Experience designing and facilitating incident response readiness activities, including tabletop exercises, simulation drills, playbook walkthroughs, war room simulations, service failovers, recovery rehearsals, and after-action reviews.
•    Familiarity with BCDR concepts, BIA outputs, RTO/RPO targets, recovery planning, escalation frameworks, crisis management practices, business continuity operating models, service restoration practices, and enterprise resiliency standards.
•    Technical familiarity with cybersecurity operations, application recovery, infrastructure recovery, cloud services, backups, replication, virtualization, endpoint recovery, networking, third-party dependencies, and service management processes.
•    Strong facilitation and coordination skills, with the ability to lead cross-functional readiness workshops, response planning sessions, exercises, post-mortems, remediation reviews, and stakeholder briefings.
•    Strong documentation, training, reporting, project coordination, governance support, and continuous improvement capabilities, including the ability to develop maturity metrics and communicate program health.
•    Certifications preferred: GCIH, CISSP, CISM, CBCP, DRCP, MBCP, ISO 22301 Lead Implementer or Auditor, ITIL, CISA, or related incident response, cybersecurity, resilience, or continuity credentials.

Soft skills   
•    Analytical thinker with attention to detail and process orientation.
•    Able to translate technical risk into actionable recovery plans and testable requirements.
•    Effective trainer/facilitator and confident presenter.
•    Project oriented with the ability to manage multiple DR/IR initiatives and deliverables.
•    Calm under pressure with strong follow-through for continuous improvement.