> Markdown version of [/jobs/ext/1710893-cybersecurity-major-incident-manager](https://www.wearedevelopers.com/jobs/ext/1710893-cybersecurity-major-incident-manager). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cybersecurity Major Incident Manager - **Company:** Comcast - **Location:** Philadelphia, PA, United States (Remote available) - **Experience:** Expert - **Contract:** Permanent contract - **Skills:** Cyber Security, Intrusion Detection and Prevention, Software Vulnerability Management, Mttr - **Published:** July 17, 2026 - **Apply:** https://comcast.wd5.myworkdayjobs.com/Comcast_Careers/job/PA---Philadelphia-1701-John-F-Kennedy-Blvd/Cybersecurity-Major-Incident-Manager_R440695 ## About the Role * 7+ years of experience in cybersecurity operations, incident response support, or CSOC leadership * Proven experience leading global or distributed teams across multiple regions or time zones * Strong understanding of incident response lifecycle, coordination, and post-incident analysis (AAR/RCA) * Experience managing cross-functional teams during high-severity incidents * Strong communication and stakeholder management skills Preferred Skills * Experience with incident management or workflow platforms * Familiarity with AAR frameworks and operational governance * Knowledge of U.S. and international regulatory environments * Experience operating in a 24x7 or follow-the-sun model Skills After Action Review, Cross-Functional Teamwork, Cybersecurity Operations, Executive Communications, Leadership, Major Incident Management, Stakeholder Management, Bachelor's Degree While possessing the stated degree is preferred, Comcast also may consider applicants who hold some combination of coursework and experience, or who have extensive related professional experience. ## Description The Cybersecurity Major Incident Manager leads incident management across a distributed, follow-the-sun operating model, with accountability for incident response support and coordination, post-incident governance, and continuous improvement to ensure consistent execution, disciplined closure, and measurable risk reduction., * Lead incident response support and coordination across regions, ensuring consistent execution, rapid response, and 24x7 operational coverage. * Build and maintain the CSOC IM operating model, including staffing, escalation paths, runbooks, and surge support for major incidents * Manage and develop a distributed team of Incident Coordinators and Incident Managers across regions * Establish follow-the-sun operating rhythms and seamless regional handoff processes. * Provide leadership and oversight for the integration of vulnerability management, threat monitoring, detection engineering, and critical security telemetry to ensure visibility, coverage, and operational readiness for newly acquired environments. * Drive cybersecurity operational maturity across newly integrated businesses, ensuring incident response processes, playbooks, governance, and continuous improvement activities align with enterprise standards and regulatory requirements. * Serve as a senior incident coordinator for high-severity incidents, ensuring alignment across technical teams, business stakeholders, Legal, Privacy, and Communications * Coordinate incident response activities, ensuring actions are tracked, prioritized, and executed in alignment with the Incident Response Plan * Own incident closure quality, ensuring root cause, remediation, evidence, and documentation are complete and audit-ready * Lead After-Action Reviews (AARs) and ensure structured, outcome-driven execution * Translate AAR outputs into prioritized Cybersecurity Action Plans (CAPs) with clear ownership and timelines * Provide clear, executive-ready updates and structured communication cadence to the teams * Partner with Legal to support appropriate post-incident oversight and review requirements * Assess operational gaps and drive improvements in processes, controls, and coordination * Define and track key metrics including MTTR, closure quality, CAP completion, and incident recurrence * Establish reporting on incident trends, operational performance, and readiness gaps * Ensure alignment with regulatory requirements and regional considerations (U.S. and U.K.) * Manage relationships with external incident response providers and partners * Lead, coach, and develop a high-performing global team while driving a culture of accountability and operational rigor ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [What is the real price of one successful line of code?](https://www.wearedevelopers.com/videos/1921-what-is-the-real-price-of-one-successful-line-of-code) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [What Developers Get Wrong About Application Quality](https://www.wearedevelopers.com/videos/233-what-developers-get-wrong-about-application-quality) - [Cyber Sleuth: Finding Hidden Connections in Cyber Data](https://www.wearedevelopers.com/videos/893-cyber-sleuth-finding-hidden-connections-in-cyber-data) - [Reporting Active Exploits in 24 Hours: Are You Ready for the CRA?](https://www.wearedevelopers.com/videos/100248-reporting-active-exploits-in-24-hours-are-you-ready-for-the-cra) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [From developer to manager – what does it take to become an engineering manager?](https://www.wearedevelopers.com/magazine/42-from-developer-to-manager-what-does-it-take-to-become-an-engineering-manager) - [How to Write a CV and Interview if You Don't Fully Qualify For The Job](https://www.wearedevelopers.com/magazine/183-how-to-write-a-cv-and-interview-if-you-don-t-fully-qualify-for-the-job) - [Best Paying Remote Jobs](https://www.wearedevelopers.com/magazine/255-best-paying-remote-jobs) - [Is Software Engineering Over-Saturated?](https://www.wearedevelopers.com/magazine/418-is-software-engineering-over-saturated) - [Top 6 Hackathons for Developers in 2023](https://www.wearedevelopers.com/magazine/263-top-6-hackathons-for-developers-in-2023)