Manager, Security Incident Response

About 1Password

1Password is a leading cybersecurity company focused on creating a secure and productive digital environment. With over $400M in annual recurring revenue and recognition on the Forbes Cloud 100 for four consecutive years, the company supports over 180,000 businesses worldwide, ranging from Fortune 100 companies to innovative AI firms. Their mission is to secure digital workplaces by ensuring authenticated identities, safe application sign-ins, and trusted devices. Their pioneering Unified Access Management system exemplifies their commitment to innovative cybersecurity solutions.

Role Overview

The Manager of Security Incident Response at 1Password plays a pivotal role in managing and improving the processes for responding to critical security incidents. This position involves leading a skilled team that not only manages incidents but also builds automations, tools, and systems to enhance response efficiency and scalability. The role integrates strong leadership, technical expertise, and sound decision-making, reporting to the Senior Manager of Threat Operations. This is a remote role open to candidates based in Canada and the US.

Responsibilities

• Lead and develop a team of incident responders, establishing clear roles, ownership, and supporting career growth.
• Assign tasks strategically considering team strengths and workloads while ensuring outcomes remain accountable.
• Define and execute a strategic roadmap for incident response, focusing on program maturity, threat hunting, and insider risk investigations as ongoing capabilities.
• Manage competing priorities between incident handling, strategic projects, and team development, making effective tradeoffs and resisting unsustainable demands.
• Enhance team capacity with AI-driven automation and tooling, maintaining rigorous controls over human oversight and decision making.
• Oversee the entire incident lifecycle including detection, triage, containment, and remediation, especially managing high-severity or complex events.
• Collaborate with Detection Engineering, Cyber Threat Intelligence, Red Team, and other groups to close detection and response gaps.
• Maintain and improve playbooks, training, drills, and metrics to boost operational readiness and maturity.
• Participate in the incident response on-call rotation, acting as the escalation contact and incident manager when necessary.
• Monitor and report trends, operational metrics, and effects of automation and AI tools on response efficiency and coverage.

Qualifications and Experience

• Over 5 years of experience in security incident response with at least 2 years in a managerial or technical leadership role with responsibility for career and performance management.
• Demonstrated ability to build or scale incident response automation, tooling, or AI-augmented workflows, exercising sound judgment regarding automation use.
• Experienced in setting clear expectations, delegating responsibility, and measuring team outcomes effectively.
• Proven experience leading security incidents under pressure with clarity and composure.
• Deep understanding of cloud-native, SaaS, and identity-based attack methods and responsive strategies.
• Strong communication skills with ability to convey complex technical concepts and decisions to both technical and non-technical stakeholders.
• Skilled in decomposing strategic goals into projects, managing competing priorities within team workflows.
• A passion for fostering psychological safety, team stability, and growth within stressful and dynamic settings.

Desired Personal Traits

• People-oriented leadership that emphasizes development, safety, and performance.
• An innovative mindset focused on systemic thinking, automation, and team culture of building solutions.
• Proactive in identifying operational risks and inefficiencies with a drive to implement AI-assisted improvements.
• Effective at building alignment across diverse teams with varied perspectives.
• Calmness and decisiveness in crisis situations, capable of prioritizing and making difficult decisions.
• Clear and transparent communication fostering trust and alignment on security initiatives.
• A dedication to protecting users, data, and organizational assets.

Company Culture and Values

1Password values collaboration, transparency, openness to feedback, and adherence to core principles: simplicity, honesty, and a people-first approach. The company embraces innovation, challenges traditional thinking, and demands a high caliber of work ethic and adaptability. It offers a fast-paced environment for those eager to take on complex problems and pursue continuous learning and impact.

Work with AI at 1Password

AI technology is strategically integrated across development and security processes to enhance productivity and security without compromising quality or ethics. All employees are encouraged to engage thoughtfully with AI, contributing to its thoughtful application and continuous learning. Candidates may responsibly use AI in their application process, but live interviews occur without AI assistance to assess direct communication and problem-solving skills.

Remote Work Commitment

As a remote-first company but valuing in-person connection, 1Password requires employees to participate in periodic onsite events such as department offsites and customer engagements. Remote work is supported primarily from the employee's home country.

Compensation and Benefits

For Canadian roles, the annual salary ranges between 171,000 CAD and 248,000 CAD, paired with comprehensive benefits including health and dental coverage, retirement savings plans (RRSP), substantial paid time off, equity grants, and participation in incentive programs. Benefits also encompass maternity and parental leave top-ups, volunteer days, peer recognition programs, and a free personal 1Password account.

Equal Opportunity and Accessibility

1Password is an equal opportunity employer committed to creating an inclusive workplace embracing diversity in all forms. Accommodations are available during recruitment upon request, supporting equal access and participation. Employment offers are contingent on satisfactory background checks compliant with local laws.