Senior Level Emergency Response Coordinator Jobs
Senior level emergency response coordinator jobs place experienced professionals in charge of crisis planning, operational response, and the cross-functional teams that execute under pressure. Openings concentrate across Technology & Software, Healthcare & Medical Services, and Investment & Asset Management, with a mix of on-site, remote, and hybrid settings, and employers like Verkada, Blackbaud, and Snap hiring at this level now.
Find JobsOverview
Showing 5 of 13+ Senior Level Emergency Response Coordinator jobs
Job Description
Workday Job Profile: Principal Security Engineer
Business/Posting Title: Principal Security Engineer, Incident Response
Grade: 11
Job Summary:
The Principal Security Engineer, Incident Response is a senior technical cybersecurity role responsible for leading the investigation, containment, eradication, and recovery of security incidents across Advance Auto Parts’ enterprise environment.
Reporting to the Sr. Manager, Cybersecurity Incident Response, this role serves as a technical lead and escalation point within the Incident Response (IR) program. The role is responsible for ensuring incidents are rapidly triaged, thoroughly investigated, and fully remediate while minimizing risk to business operations, customers, team members, and company reputation.
The Senior Incident Responder will partner across Cybersecurity, Technology, Legal, Privacy, Risk Management, Store Operations, and Supply Chain Operations to resolve complex security events and strengthen enterprise resilience against modern threats, including ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches.
What will you do?
Incident Response & Investigations
- Lead technical response to high-severity cybersecurity incidents from detection through closure.
- Serve as technical lead and deputy to the Incident Commander during major cybersecurity events.
- Investigate and respond to ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
- Perform host, network, memory, log, and cloud forensic analysis to determine root cause, scope, and impact.
- Execute containment, eradication, and recovery actions in coordination with Technology and business teams.
- Preserve evidence and maintain chain of custody in support of legal, regulatory, privacy, and cyber insurance requirements.
- Serve as the escalation point for junior incident responders on complex or ambiguous security events.
- Produce clear, timely incident documentation, technical findings, and status updates for leadership.
Threat Hunting & Detection
- Conduct proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
- Translate incident findings into new or improved detections aligned to MITRE ATT&CK.
- Partner with Engineering teams to tune monitoring technologies and improve signal-to-noise ratios.
- Leverage threat intelligence to enrich investigations and anticipate threat actor TTPs targeting the retail industry.
- Identify opportunities to automate triage, enrichment, and response actions.
Cyber Preparedness & Resilience
- Develop, maintain, and test incident response playbooks so they remain current and actionable.
- Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
- Lead post-incident reviews and track corrective actions through completion.
- Contribute incident data to operational metrics, including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
Collaboration & Mentorship
- Mentor and develop junior incident responders through case reviews and hands-on coaching.
- Share knowledge through runbooks, training sessions, and lessons learned.
- Coordinate with external IR retainers, forensic vendors, and law enforcement as directed.
- Model a culture of accountability, resilience, and continuous improvement.
Location & Work Availability:
This position is Hybrid (4 days in office, 1 day remote), based at our corporate headquarters in Raleigh, North Carolina.
Qualifications:
- 6+ years of experience in cybersecurity, with at least 3 years focused on incident response, digital forensics, or threat hunting.
- Proven experience leading investigations of ransomware, business email compromise, cloud, and identity-based attacks.
- Hands-on expertise with security technologies (SIEM, SOAR, EDR, cloud security tools, network and forensic analysis tools).
- Working knowledge of Windows, Linux, Active Directory/Entra ID, and major cloud platforms (AWS, Azure, or GCP).
- Experience with cybersecurity frameworks (NIST SP 800-61, NIST CSF, MITRE ATT&CK).
- Scripting ability (Python, PowerShell, or similar) to support investigations and automation.
- Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.
Preferred Qualifications
- Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
- Experience in large-scale, complex organizations, retail, or highly regulated industries.
- Expertise in cybersecurity automation and analytics.
Certifications, Experience, and Education:
- Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
Benefits Summary:
We believe in supporting our Team Members and those they love through comprehensive health & wellness benefits. Learn more here: https://jobs.advanceautoparts.com/us/en/benefits
Company Overview:
Advance Auto Parts, Inc. is a leading automotive aftermarket parts provider that serves both professional installer and do-it-yourself customers. As of January 3, 2026, Advance operated 4,305 stores primarily within the United States, with additional locations in Canada, Puerto Rico and the U.S. Virgin Islands. The Company also served 809 independently owned Carquest branded stores across these locations in addition to Mexico and various Caribbean islands. Additional information about Advance, including employment opportunities, customer services, and online shopping for parts, accessories and other offerings can be found at www.AdvanceAutoParts.com.
We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age national origin, religion, sexual orientation, gender identity, status as a veteran and basis of disability or any other federal, state, or local protected class.
California Residents click below for Privacy Notice:
https://jobs.advanceautoparts.com/us/en/disclosures
Job Description
Workday Job Profile: Principal Security Engineer
Business/Posting Title: Principal Security Engineer, Incident Response
Grade: 11
Job Summary:
The Principal Security Engineer, Incident Response is a senior technical cybersecurity role responsible for leading the investigation, containment, eradication, and recovery of security incidents across Advance Auto Parts’ enterprise environment.
Reporting to the Sr. Manager, Cybersecurity Incident Response, this role serves as a technical lead and escalation point within the Incident Response (IR) program. The role is responsible for ensuring incidents are rapidly triaged, thoroughly investigated, and fully remediate while minimizing risk to business operations, customers, team members, and company reputation.
The Senior Incident Responder will partner across Cybersecurity, Technology, Legal, Privacy, Risk Management, Store Operations, and Supply Chain Operations to resolve complex security events and strengthen enterprise resilience against modern threats, including ransomware, identity-based attacks, cloud compromises, insider threats, and third-party breaches.
What will you do?
Incident Response & Investigations
- Lead technical response to high-severity cybersecurity incidents from detection through closure.
- Serve as technical lead and deputy to the Incident Commander during major cybersecurity events.
- Investigate and respond to ransomware, malware outbreaks, business email compromise, credential theft, cloud compromise, insider threats, and third-party breaches.
- Perform host, network, memory, log, and cloud forensic analysis to determine root cause, scope, and impact.
- Execute containment, eradication, and recovery actions in coordination with Technology and business teams.
- Preserve evidence and maintain chain of custody in support of legal, regulatory, privacy, and cyber insurance requirements.
- Serve as the escalation point for junior incident responders on complex or ambiguous security events.
- Produce clear, timely incident documentation, technical findings, and status updates for leadership.
Threat Hunting & Detection
- Conduct proactive, hypothesis-driven threat hunts to identify advanced attacker activity.
- Translate incident findings into new or improved detections aligned to MITRE ATT&CK.
- Partner with Engineering teams to tune monitoring technologies and improve signal-to-noise ratios.
- Leverage threat intelligence to enrich investigations and anticipate threat actor TTPs targeting the retail industry.
- Identify opportunities to automate triage, enrichment, and response actions.
Cyber Preparedness & Resilience
- Develop, maintain, and test incident response playbooks so they remain current and actionable.
- Support tabletop exercises, ransomware preparedness exercises, and cyber crisis simulations.
- Lead post-incident reviews and track corrective actions through completion.
- Contribute incident data to operational metrics, including Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR).
Collaboration & Mentorship
- Mentor and develop junior incident responders through case reviews and hands-on coaching.
- Share knowledge through runbooks, training sessions, and lessons learned.
- Coordinate with external IR retainers, forensic vendors, and law enforcement as directed.
- Model a culture of accountability, resilience, and continuous improvement.
Location & Work Availability:
This position is Hybrid (4 days in office, 1 day remote), based at our corporate headquarters in Raleigh, North Carolina.
Qualifications:
- 6+ years of experience in cybersecurity, with at least 3 years focused on incident response, digital forensics, or threat hunting.
- Proven experience leading investigations of ransomware, business email compromise, cloud, and identity-based attacks.
- Hands-on expertise with security technologies (SIEM, SOAR, EDR, cloud security tools, network and forensic analysis tools).
- Working knowledge of Windows, Linux, Active Directory/Entra ID, and major cloud platforms (AWS, Azure, or GCP).
- Experience with cybersecurity frameworks (NIST SP 800-61, NIST CSF, MITRE ATT&CK).
- Scripting ability (Python, PowerShell, or similar) to support investigations and automation.
- Excellent written and verbal communication skills, including the ability to explain technical findings to non-technical audiences.
Preferred Qualifications
- Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
- Experience in large-scale, complex organizations, retail, or highly regulated industries.
- Expertise in cybersecurity automation and analytics.
Certifications, Experience, and Education:
- Certifications: GCIH, GCFA, GCFE, GNFA, GREM, CISSP
Benefits Summary:
We believe in supporting our Team Members and those they love through comprehensive health & wellness benefits. Learn more here: https://jobs.advanceautoparts.com/us/en/benefits
Company Overview:
Advance Auto Parts, Inc. is a leading automotive aftermarket parts provider that serves both professional installer and do-it-yourself customers. As of January 3, 2026, Advance operated 4,305 stores primarily within the United States, with additional locations in Canada, Puerto Rico and the U.S. Virgin Islands. The Company also served 809 independently owned Carquest branded stores across these locations in addition to Mexico and various Caribbean islands. Additional information about Advance, including employment opportunities, customer services, and online shopping for parts, accessories and other offerings can be found at www.AdvanceAutoParts.com.
We are an Equal Opportunity Employer and do not discriminate against any employee or applicant for employment because of race, color, sex, age national origin, religion, sexual orientation, gender identity, status as a veteran and basis of disability or any other federal, state, or local protected class.
California Residents click below for Privacy Notice:
https://jobs.advanceautoparts.com/us/en/disclosures
See All 13 Senior Level Emergency Response Coordinator Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsSenior Level Emergency Response Coordinator Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Healthcare & Medical Services
- Investment & Asset Management
- Manufacturing
- Law & Legal Services
Senior Level Emergency Response Coordinator Jobs: Frequently Asked Questions
How do I get a senior level emergency response coordinator job?
Employers at this level look for candidates who have led multi-agency responses, developed or revised emergency operations plans, and can demonstrate measurable outcomes from past incidents. Certifications such as a Certified Emergency Manager credential and experience with NIMS or ICS frameworks strengthen a candidacy considerably. Tailoring your application to show ownership of specific programs, not just participation, is what separates competitive senior applicants from the rest.
Which companies hire senior level emergency response coordinators?
Companies hiring senior level emergency response coordinators right now include Verkada, Blackbaud, and Snap, based on current listings on Migrate Mate as of November 2026. At this level, hiring tends to come from large corporations with dedicated security or continuity functions, government contractors, healthcare systems, utilities, and municipalities that require seasoned leadership for high-stakes response programs.
Are there remote senior level emergency response coordinator jobs?
Yes, though many roles require some on-site presence given the operational nature of emergency response work. About 58% of senior level emergency response coordinator openings are remote or hybrid as of November 2026, reflecting demand for experienced professionals who can lead planning, training, and coordination functions that do not require a physical presence at every stage.
What makes an emergency response coordinator role senior level?
Senior level roles are defined by program ownership, not just execution. Professionals at this stage are accountable for designing enterprise-wide emergency operations plans, directing responses across multiple departments or locations, and mentoring junior coordinators. They advise leadership on risk posture, manage vendor and agency relationships independently, and are expected to operate with minimal oversight in high-pressure situations.
Which industries hire the most senior level emergency response coordinators?
Senior level emergency response coordinator roles concentrate in Technology & Software, Healthcare & Medical Services, and Investment & Asset Management, based on current listings on Migrate Mate as of November 2026. These sectors drive hiring at this level because they operate critical infrastructure, face significant regulatory compliance requirements, or manage large populations and assets where mature emergency leadership directly reduces organizational risk.