H-1B Visa Incident Manager Jobs
Incident Manager roles qualify as H-1B visa specialty occupations because they require a bachelor's degree or higher in information technology, computer science, or a related field. Employers in tech, financial services, and healthcare regularly file H-1B petitions for this role. The annual H-1B cap opens each April, with the lottery typically run in March.
Find H-1B Visa Incident Manager JobsOverview
Showing 5 of 77+ Incident Manager jobs
See all 77+ Incident Manager Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Incident Manager roles.
Get Access To All JobsLocation:
Southfield, MI, US, 48033
Country/Region: United States
Job Function: Information Technology
Requisition ID: 50073
Employment Type: Salary
Lear For You
We work hard for the people who work for us. We champion our teams and foster collaboration, inclusion, respect and excellence. Because we want to be more for you.
A path to a better career. A better future.
Our teams have invented groundbreaking technologies, manufactured millions of products and earned a long list of awards. Year after year, we’re named one of the World’s Most Admired Companies.
They’re the secret to our success—empowered, inventive and inclusive. Passionate about their craft. Driven to succeed. Because we win together.
Are you ready for a better career? A better future?
Job Description
We are looking for an experienced Team Lead to help guide our global Threat Detection & Incident Response (TDIR) team. The team is a Tier 2+ function that handles escalations from our 24/7 Managed Security Services Provider (MSSP), leads incident response, performs digital forensics, conducts cyber threat intelligence analysis, and owns the security platforms that power our detection program. This is a hands-on leadership role. You'll be the team's go-to technical and process escalation point, mentor team members across three regions, run key team rhythms, and take ownership of platform health and vendor relationships. You'll work closely with the TDIR Manager and play a central part in how the team operates, grows and scales.
Responsibilities
- Act as the primary technical escalation point for complex investigations, guiding engineers on where to look, what to collect and whom to engage.
- Lead or coordinate response to significant security incidents, including containment, eradication, recovery, stakeholder communication and post-incident reviews.
- Define, maintain and improve IR processes, playbooks and runbooks aligned with frameworks such as NIST SP 800-61 and MITRE ATT&CK.
- Communicate process changes clearly across regions and ensure procedures are followed during incidents.
- Track and report operational metrics (e.g., MTTD/MTTR, escalation quality, detection coverage) and recommend improvements.
- Own the health, adoption and continuous tuning of the team's security platforms (EDR, SIEM, email security, threat intelligence, and related tooling).
- Keep detections and configurations current with emerging threats; manage upgrades, integrations and use-case roadmaps.
- Ensure platforms are properly documented and that knowledge is shared across the team to avoid single points of failure.
- Serve as a primary point of contact for the MSSP and key security vendors, ensuring services meet agreed SLAs and organizational expectations.
- Participate in Quarterly Business Reviews (QBRs), product reviews and service improvement plans, and drive resulting action items through completion.
Your Qualifications
- 7+ years of experience in security operations, incident response, threat detection or digital forensics.
- 2+ years leading or mentoring others (team lead, shift lead, senior analyst with formal mentoring responsibility, or similar).
- Deep, hands-on incident response experience across endpoint, identity, email and cloud environments.
- Strong working knowledge of EDR and SIEM platforms, including writing queries and detections.
- Experience working with or overseeing an MSSP/MDR provider.
- Solid understanding of MITRE ATT&CK, the IR lifecycle and the application of threat intelligence to detection and response.
- Excellent written and verbal communication, with the ability to brief both technical teams and leadership.
- Comfortable working with a global team and occasionally adjusting hours to support other time zones and active incidents.
Bonus If You Have
- Experience in manufacturing, automotive or other large, global enterprise environments, including OT exposure.
- Scripting/automation skills (PowerShell, Python) and SOAR experience.
- Experience managing vendor relationships, SLAs and QBRs.
- Experience building playbooks, training programs or analyst development plans.
Experience with Any of the Following Is a Strong Plus
- EDR / XDR: CrowdStrike Falcon (Insight, Spotlight and Identity)
- SIEM: Splunk / Splunk Cloud (SPL, custom detection development)
- Email Security: Proofpoint
- Threat Intelligence: Recorded Future
- MDR Model: 24/7 MSSP Level 1 triage with in-house Tier 2+ response
Certifications – Preferred, Not Required
- GIAC: GCIH, GCFA, GCIA, GCTI or GNFA
- CISSP or CISM
- CompTIA CySA+ / CASP+
- Vendor certifications (e.g., CrowdStrike CCFR/CCFH, Splunk Certified Power User/Admin)
Equal Opportunity Employer
Lear Corporation is committed to fair, merit‑based employment practices and equal opportunity.
We provide reasonable accommodations in accordance with applicable law. For assistance during the application process, contact your recruiter directly.
Applicants must submit their resume for consideration using our applicant tracking system. Due to the high volume of applications received, only candidates selected for interviews will be contacted. Candidates must be legally authorized to work in the country where the position is located. Unsolicited resumes from search firms, employment agencies, or similar, will not be paid a fee and will become the property of Lear Corporation.
Location:
Southfield, MI, US, 48033
Country/Region: United States
Job Function: Information Technology
Requisition ID: 50073
Employment Type: Salary
Lear For You
We work hard for the people who work for us. We champion our teams and foster collaboration, inclusion, respect and excellence. Because we want to be more for you.
A path to a better career. A better future.
Our teams have invented groundbreaking technologies, manufactured millions of products and earned a long list of awards. Year after year, we’re named one of the World’s Most Admired Companies.
They’re the secret to our success—empowered, inventive and inclusive. Passionate about their craft. Driven to succeed. Because we win together.
Are you ready for a better career? A better future?
Job Description
We are looking for an experienced Team Lead to help guide our global Threat Detection & Incident Response (TDIR) team. The team is a Tier 2+ function that handles escalations from our 24/7 Managed Security Services Provider (MSSP), leads incident response, performs digital forensics, conducts cyber threat intelligence analysis, and owns the security platforms that power our detection program. This is a hands-on leadership role. You'll be the team's go-to technical and process escalation point, mentor team members across three regions, run key team rhythms, and take ownership of platform health and vendor relationships. You'll work closely with the TDIR Manager and play a central part in how the team operates, grows and scales.
Responsibilities
- Act as the primary technical escalation point for complex investigations, guiding engineers on where to look, what to collect and whom to engage.
- Lead or coordinate response to significant security incidents, including containment, eradication, recovery, stakeholder communication and post-incident reviews.
- Define, maintain and improve IR processes, playbooks and runbooks aligned with frameworks such as NIST SP 800-61 and MITRE ATT&CK.
- Communicate process changes clearly across regions and ensure procedures are followed during incidents.
- Track and report operational metrics (e.g., MTTD/MTTR, escalation quality, detection coverage) and recommend improvements.
- Own the health, adoption and continuous tuning of the team's security platforms (EDR, SIEM, email security, threat intelligence, and related tooling).
- Keep detections and configurations current with emerging threats; manage upgrades, integrations and use-case roadmaps.
- Ensure platforms are properly documented and that knowledge is shared across the team to avoid single points of failure.
- Serve as a primary point of contact for the MSSP and key security vendors, ensuring services meet agreed SLAs and organizational expectations.
- Participate in Quarterly Business Reviews (QBRs), product reviews and service improvement plans, and drive resulting action items through completion.
Your Qualifications
- 7+ years of experience in security operations, incident response, threat detection or digital forensics.
- 2+ years leading or mentoring others (team lead, shift lead, senior analyst with formal mentoring responsibility, or similar).
- Deep, hands-on incident response experience across endpoint, identity, email and cloud environments.
- Strong working knowledge of EDR and SIEM platforms, including writing queries and detections.
- Experience working with or overseeing an MSSP/MDR provider.
- Solid understanding of MITRE ATT&CK, the IR lifecycle and the application of threat intelligence to detection and response.
- Excellent written and verbal communication, with the ability to brief both technical teams and leadership.
- Comfortable working with a global team and occasionally adjusting hours to support other time zones and active incidents.
Bonus If You Have
- Experience in manufacturing, automotive or other large, global enterprise environments, including OT exposure.
- Scripting/automation skills (PowerShell, Python) and SOAR experience.
- Experience managing vendor relationships, SLAs and QBRs.
- Experience building playbooks, training programs or analyst development plans.
Experience with Any of the Following Is a Strong Plus
- EDR / XDR: CrowdStrike Falcon (Insight, Spotlight and Identity)
- SIEM: Splunk / Splunk Cloud (SPL, custom detection development)
- Email Security: Proofpoint
- Threat Intelligence: Recorded Future
- MDR Model: 24/7 MSSP Level 1 triage with in-house Tier 2+ response
Certifications – Preferred, Not Required
- GIAC: GCIH, GCFA, GCIA, GCTI or GNFA
- CISSP or CISM
- CompTIA CySA+ / CASP+
- Vendor certifications (e.g., CrowdStrike CCFR/CCFH, Splunk Certified Power User/Admin)
Equal Opportunity Employer
Lear Corporation is committed to fair, merit‑based employment practices and equal opportunity.
We provide reasonable accommodations in accordance with applicable law. For assistance during the application process, contact your recruiter directly.
Applicants must submit their resume for consideration using our applicant tracking system. Due to the high volume of applications received, only candidates selected for interviews will be contacted. Candidates must be legally authorized to work in the country where the position is located. Unsolicited resumes from search firms, employment agencies, or similar, will not be paid a fee and will become the property of Lear Corporation.
See all 77+ H-1B Visa Incident Manager Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new H-1B Visa Incident Manager Jobs.
Get Access To All JobsTips for Finding H-1B Visa Sponsorship as an Incident Manager
Align your degree to the role
USCIS requires your degree field to directly relate to Incident Manager duties. A computer science, information systems, or IT management degree is the cleanest fit. If your degree is in a tangential field, gather course transcripts to demonstrate the overlap before applying.
Check employer LCA filing history
Use the OFLC Wage Search to verify that a prospective employer has filed Labor Condition Applications for Incident Manager or related IT operations roles. Employers with a consistent LCA history are more likely to run an established H-1B sponsorship process.
Search verified sponsors on Migrate Mate
Filter Incident Manager openings by H-1B sponsorship history on Migrate Mate. The platform surfaces employers whose DOL LCA filings confirm they sponsor this role, so you spend time on leads that are already qualified rather than guessing from a job listing.
Register before the March lottery window
USCIS opens H-1B registration in early March each year for a roughly two-week window. Your employer must register you during that period, and selection results come out before April 1. Confirm your employer's internal HR timeline at least 60 days before the window opens.
Prepare ITIL or incident-response documentation early
Incident Manager petitions sometimes draw USCIS requests for evidence about whether the role genuinely requires a degree. Documenting your ITIL certification, formal incident response frameworks, and project scope strengthens the specialty occupation argument in your I-129 petition.
Understand O*NET job zone classification
The O*NET profile for Operations Research Analysts and Computer and Information Systems Managers, which overlaps with Incident Manager duties, sits in Job Zone 4, requiring substantial education. Reference this classification if your employer's attorney needs to argue specialty occupation status.
H-1B Visa Incident Manager: Frequently Asked Questions
Does an Incident Manager role qualify as a specialty occupation for H-1B purposes?
Yes, provided the position requires at least a bachelor's degree in a specific field such as computer science, information technology, or information systems. USCIS evaluates the job description, not just the title. If your employer writes the role to include degree-specific competencies like ITIL framework application, incident lifecycle management, or systems architecture analysis, it should meet the specialty occupation threshold.
Which industries sponsor H-1B visas most often for Incident Manager positions?
Financial services, cloud infrastructure, healthcare IT, and managed service providers file the largest volume of H-1B Labor Condition Applications for IT operations and incident management roles. Consulting firms that embed Incident Managers at client sites also sponsor regularly. You can verify specific employer filing patterns through the OFLC Wage Search before applying. Migrate Mate filters these employers by verified sponsorship history.
What happens to my H-1B status if my employer terminates me before the petition ends?
USCIS provides a 60-day grace period from the date of termination, during which you can secure a new H-1B sponsor, file for a change of status, or depart the U.S. Your new employer must file an H-1B transfer petition before the grace period expires. The transfer can use your remaining petition validity, so you don't necessarily need to re-enter the lottery.
Can I transfer my H-1B to a new Incident Manager role without losing my place in the queue?
H-1B portability under AC21 allows you to transfer to a same or similar role after your I-140 has been approved and your adjustment of status application has been pending for at least 180 days. For workers still on cap-subject H-1B status without a green card petition, your new employer files a new or amended I-129 and you begin working once USCIS receives it, not after approval.
Does certification like ITIL or PMP strengthen an H-1B petition for Incident Manager roles?
Certifications don't substitute for the degree requirement, but they reinforce the specialty occupation argument by showing the role demands specialized professional knowledge. If USCIS issues a Request for Evidence questioning whether the position requires a degree, ITIL Foundation or ITIL 4 Managing Professional credentials help demonstrate that the work exceeds general IT support. Include them in the supporting documentation your employer submits with the I-129.