Cyber Security Incident Response Manager

The Cyber Security Incident Response IR Manager will play a pivotal role within WTW’s Global Information and Cyber Security Defence (ICSD) function, leading the response to complex security incidents and driving initiatives to enhance WTW’s Cyber incident management capabilities. This mid senior-level role requires a highly experienced professional with more than 5 years of expertise in incident response and cybersecurity.

As a key player in WTW’s Cyber Defense strategy, you will establish and refine incident response procedures, collaborate with diverse stakeholders across the organization, and engage closely with other Cyber-Defense teams, including SOC, Threat Hunting, Cyber Threat Intelligence (CTI), and Insider Threat. You will also work beyond the technical domain, liaising with HR, Legal, Compliance, and other business units to ensure effective incident management and mitigation.

The individual will work as part of a global, multi-disciplined security community with strong support across the business, contributing to fostering a security-aware culture while ensuring WTW remains a great place to work. With WTW’s large global footprint, this role offers a fascinating range of work, and occasional global travel may be required.

The Role

The Cyber Security Cloud Incident Response IR Manager will play a key role in managing and responding to security incidents within WTW’s Cyber Security Incident Response Team. Responsibilities of this role will include:

• Serve as the primary lead for significant security incidents, coordinating response efforts across technical and business teams to minimize impact and ensure timely resolution.

• Seasoned Cloud Security Incident Response leader with deep expertise in Azure, AWS, and GCP, driving rapid containment and remediation of complex threats across hybrid environments.

• Proven track record in orchestrating cross-cloud IR workflows and forensic investigations, ensuring resilient security posture and regulatory compliance.

• Adept at leading global response teams, integrating SIEM/SOAR platforms, and collaborating with MSSPs to mitigate cloud-native and supply chain attack

• Establish, refine, and maintain incident response processes, playbooks, and workflows to align with industry best practices and WTW’s organizational needs.

• Act as the central point of contact for incident response activities, ensuring effective communication with internal and external stakeholders, including senior leadership, Legal, HR, and Compliance teams.