Manager, Security Incident Response

As our Manager, Security Incident Response, you are at the center of how 1Password handles the moments that matter most. You will build and lead a team of builders: responders who don't just work incidents, but engineer the automation, tooling, and systems that make response faster and more scalable over time. You will guide program maturity, scale the team's capabilities through AI-assisted tooling, reinforce operational excellence, and step in as incident manager during complex, high-severity events. Success in this role blends strong people leadership with technical depth and sound judgment. As part of the Security leadership team, you will shape response strategy, build effective cross-functional partnerships, and help protect a product trusted by millions.

This role reports to the Senior Manager, Threat Operations.

What we're looking for:

• 5+ years in security incident response, with 2+ years as a people manager or technical leader supporting career development and performance management.
• Experience building or scaling incident response automation, tooling, or AI-assisted workflows (triage, enrichment, investigation), with sound judgment about where automation should and shouldn’t make decisions.
• Experience setting clear expectations, defining ownership, delegating work, and measuring outcomes.
• Experience managing high-pressure security incidents with clarity, structure, and calm.
• Strong understanding of cloud-native, SaaS, and identity-driven attack techniques and how to respond to them.
• Strong communication skills, including the ability to explain complex findings, tradeoffs, and recommendations to technical and non-technical audiences.
• Experience breaking down strategic initiatives into projects, coordinating team sprints, and managing work across competing priorities.
• Passion for fostering psychological safety and stability in stressful environments.

Who you are:

• A people-first leader who prioritizes team development, psychological safety, and performance.
• A builder at heart, someone who thinks in systems and automation, not just case queues, and hires and develops engineers with that same instinct.
• Proactive in identifying gaps, inefficiencies, or operational risks and bringing forward actionable solutions, including where AI or automation can close them.
• Effective at driving alignment across teams with differing priorities and perspectives.
• Calm and decisive during high-pressure situations, with the judgment to prioritize effectively and make difficult tradeoffs.
• A clear and transparent communicator who can align teams with differing priorities, surface tradeoffs, and advocate for sound security decisions.
• Motivated by protecting people, data, and the business.

What you can expect:

• Build, lead, and develop a team of incident responders and security builders, setting clear expectations, creating meaningful ownership, and supporting growth.
• Delegate effectively based on team strengths, development goals, capacity, and operational needs while maintaining accountability for outcomes.
• Define and drive the security incident response roadmap and strategic priorities, including maturing agentic incident response, structured threat hunting, and insider risk investigations as sustained, scaled capabilities rather than one-time builds.
• Balance competing priorities across incident response, strategic initiatives, and team development; make tradeoffs clear and push back when timelines, approaches, or requests create unnecessary risk or unsustainable workload.
• Scale team capacity through AI-assisted tooling and automation, maintaining appropriate controls around human judgment, approval, auditability, and rollback.
• Oversee detection, triage, containment, remediation, and post-incident learning, serving as an escalation point and incident manager for complex or high-severity events.
• Partner with Detection Engineering, Cyber Threat Intelligence, Red Team and other teams to improve cross-functional processes and close detection or response gaps identified through investigations.
• Evolve playbooks, training, tabletop exercises, metrics, and reporting to strengthen operational readiness and program maturity.
• Participate in the on-call rotation, serving as the leadership escalation or incident manager during major or complex incidents.
• Track and report on incident trends, operational metrics, and program maturity, including the impact of automation and AI tooling on response time and coverage.