The position is described below. If you want to apply, click the Apply Now button at the top or bottom of this page. After you click Apply Now and complete your application, you'll be invited to create a profile, which will let you see your application status and any communications. If you already have a profile with us, you can log in to check status.

Need Help?

If you have a disability and need assistance with the application, you can request a reasonable accommodation. Send an email to Accessibility (accommodation requests only; other inquiries won't receive a response).

Regular or Temporary:

Regular

Language Fluency:  English (Required)

Work Shift:

1st shift (United States of America)

Please review the following job description:

Leads enterprise cyber incident and high-risk vulnerability response efforts, coordinating cross-functional teams to rapidly assess, contain, and remediate threats. Operates effectively in high-pressure, time-sensitive situations requiring rapid coordination and decision-making. Serves as a central point of orchestration, ensuring timely decisions, clear executive communication, and effective risk mitigation aligned to enterprise incident management practices.

ESSENTIAL DUTIES AND RESPONSIBILITIES
Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.Lead Incident Coordination

• Act as Incident Manager / Incident Coordinator for information security incidents, investigations, events, zero-days, and high-risk vulnerabilities.
• Drive end-to-end response from intake through containment, remediation, and closure.
• Drive real-time risk-based decisioning, including severity classification, event escalation, and prioritization of containment and remediation actions.

Facilitate Cross-Functional Response

• Coordinate SOC, Threat Intel, Vulnerability Management, Engineering, Application, Infrastructure, Business, Legal, Regulatory and Risk Oversight teams.
• Establish clear ownership, timelines, and accountability across all stakeholders

Drive Triage & Risk-Based Decisioning

• Assess exposure, exploitability, and business impact to determine severity and urgency qualifications.
• Escalate conditions requiring executive awareness or rapid response actions.

Lead Incident Calls & Execution Rhythm

• Run high-pressure, high-visibility structured incident meetings with defined objectives, action tracking, and decision capture.
• Maintain momentum and remove blockers to accelerate containment and remediation.

Executive Communication & Reporting

• Develop and deliver concise, executive-ready communications, including risk articulation, business impact, and remediation status.
• Provide detailed reporting of residual risk, blockers, and required decisions

Ensure Effective Containment & Remediation

• Validate that immediate mitigations and long-term fixes are executed and prioritized appropriately.
• Track progress against SLAs, emergency changes, and remediation timelines.

Oversight of Incident Lifecycle & Documentation

• Maintain accurate timelines, decisions, and evidence within incident records
• Ensure alignment with established incident management frameworks and escalation models.

Post-Incident Review & Continuous Improvement

• Lead or support lessons learned, root cause analysis, and control improvement recommendations.
• Identify systemic gaps and drive enhancements to response processes and playbooks.

Stakeholder & Business Engagement

• Partner with business units and application owners to align response actions with operational priorities.
• Support regulatory, legal, and risk partners as needed during incidents.

Work Environment & Availability Expectations

Full-time in-office role (5 days / week) in Atlanta, Charlotte, Greensboro, Raleigh, or Richmond. Participation in an on-call rotation is required. Must support after-hours, weekend, and holiday incident response as needed. Ability to respond to time-sensitive cyber events outside standard business hours is required.

Qualifications
Required Qualifications
The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
1. Bachelor’s degree in Computer Science, Information Systems, or related field.
2. Minimum of 5 years of professional experience in information security.
3. Strong knowledge of data security, privacy laws, regulatory compliance, and advanced security technologies.
4. Experience in threat analysis, vulnerability testing, incident response, and forensic methodologies.

Preferred Qualifications

• Experience leading enterprise cyber incident response operations.
• Strong understanding of incident management frameworks (e.g., NIST, SANS, ITR models).
• Proven ability to lead high-pressure, high-visibility, time-sensitive situations and drive decision-making.
• Experience delivering and executive-level communications and risk briefings.
• Familiarity with vulnerability management, zero-day response, and threat intelligence integration.
• Experience coordinating across infrastructure, cloud, application, and security engineering teams.
• Knowledge of financial services, regulatory matters, and risk environments. Demonstrated ability to drive accountability without direct authority (matrixed organization).
• Experience with incident management tooling, ticketing systems (ServiceNow), and collaboration platforms.
• Advanced professional certifications such as CISSP, CISM, PMP, or equivalent.

General Description of Available Benefits for Eligible Employees of Truist Financial Corporation: All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position. Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates. Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays. For more details on Truist’s generous benefit plans, please visit our Benefits site. Depending on the position and division, this job may also be eligible for Truist’s defined benefit pension plan, restricted stock units, and/or a deferred compensation plan. As you advance through the hiring process, you will also learn more about the specific benefits available for any non-temporary position for which you apply, based on full-time or part-time status, position, and division of work.

Truist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law. Truist is a Drug Free Workplace.

EEO is the Law    E-Verify IER Right to Work