Cloud Incident Responder (Vice President)
Core
Lead strategic management and response to security incidents across Citi's multi-cloud environments and data platforms.
Role type
Vice President, Cloud Incident Response
Builds
Incident response playbooks, automation capabilities, and forensic workflows for AWS, GCP, Snowflake, and Databricks.
Domain
Cloud Security / Cybersecurity
Required skills
Cloud security expertise, Incident response leadership, Cloud platform investigation (AWS, GCP), Data platform security (Snowflake, Databricks), Log aggregation and security analytics, Threat modeling, Strategic stakeholder collaboration
Preferred skills
Deep expertise in Databricks and Snowflake security, Cloud-native security posture tooling (Wiz, Aquasec, AppOmni), Security-specific certifications
Technologies
AWS, GCP, Snowflake, Databricks, Splunk, Sentinel, Chronicle, Wiz, Aquasec, AppOmni
Responsibilities
Architect incident response playbooks and automation, Conduct cloud-focused investigations using logs and telemetry, Orchestrate forensic analysis of cloud resources, Implement cloud-native containment actions, Conduct proactive threat hunting and IOC analysis, Collaborate on security architecture decisions, Document incidents and participate in threat modeling exercises
Seniority
Executive (VP), Strategy & Mentorship
