What You’ll Do
Lead the coordination of complex cybersecurity incidents, establishing response structure, communication cadence, stakeholder alignment, action tracking, and escalation paths.
Serve as a central point of coordination during high-priority incidents, bringing together security, technology, business, legal, communications, vendors, and other stakeholders as appropriate.
Coordinate incident bridges, working sessions, and communication channels, ensuring actions, decisions, owners, dependencies, and next steps remain clear throughout the response.
Develop and maintain accurate incident documentation, including timelines, decision logs, action trackers, incident summaries, post-incident reports, and lessons learned.
Draft clear, audience-appropriate incident communications, translating complex cybersecurity developments into concise updates for executives, business stakeholders, and broader internal audiences.
Partner with technical response teams to understand investigation findings, business impact, containment, remediation, and recovery status and translate those findings into coordinated actions and communications.
Plan and facilitate tabletop exercises, simulations, and incident response drills to strengthen organizational preparedness and cross-functional coordination.
Lead or support post-incident reviews and after-action activities, identifying opportunities to strengthen processes, communications, documentation, and organizational readiness.
Develop and maintain incident coordination playbooks, communication templates, escalation procedures, and supporting readiness materials.
Mentor team members and promote consistent incident coordination and crisis communication practices.
Basic Requirements
7+ years of progressive experience in cybersecurity, incident response, crisis management, security operations, business continuity, or a related field.
Experience coordinating complex cybersecurity incidents involving multiple technical and business stakeholder groups.
Experience managing incident communications, stakeholder updates, escalation, action tracking, and response coordination during high-priority events.
Demonstrated ability to communicate effectively with technical teams, business stakeholders, and senior leadership during time-sensitive situations.
Strong technical writing experience, including incident timelines, reports, briefings, playbooks, lessons learned, and other structured incident documentation.
Experience translating complex cybersecurity information into clear, concise, non-technical communications.
Experience supporting or facilitating tabletop exercises, incident simulations, preparedness activities, or post-incident reviews.
Working knowledge of cybersecurity incident response processes and terminology sufficient to effectively coordinate technical response activities.
Bachelor’s degree in Computer Science, Cybersecurity, Information Systems, Business, Communications, or equivalent related experience.
Preferred Skills/Experience
Experience coordinating major cybersecurity incidents in a large or regulated enterprise environment.
Familiarity with common incident response technologies such as SIEM, EDR/XDR, SOAR, network security, identity security, and cloud security platforms.
Understanding of digital forensics, threat analysis, containment, remediation, and recovery practices.
Experience working with vendors, managed security providers, legal, communications, business continuity, or other cross-functional incident stakeholders.
Experience developing or facilitating tabletop exercises, simulations, crisis management drills, or incident response training.
Experience developing executive-level cybersecurity communications and business-impact summaries.
Experience developing incident response playbooks, communication plans, escalation procedures, or crisis management frameworks.
Relevant certifications such as CISSP, CISM, GCIH, Security+, CySA+, or equivalent.
Travel / Work Environment / Physical Requirements
Work model, office presence, and travel expectations should be confirmed based on team and business needs.
Occasional travel may be required for team meetings, incident response support, training, or business continuity activities.
Role generally requires the ability to work at a computer for extended periods and participate in virtual or in-person meetings.
At McKesson, we care about the well-being of the patients and communities we serve, and that starts with caring for our people. That’s why we have a Total Rewards package that includes comprehensive benefits to support physical, mental, and financial well-being. Our Total Rewards offerings serve the different needs of our diverse employee population and ensure they are the healthiest versions of themselves.
As part of Total Rewards, we are proud to offer a competitive compensation package at McKesson. This is determined by several factors, including performance, experience and skills, equity, regular job market evaluations, and geographical markets. The pay range shown below is aligned with McKesson's pay philosophy, and pay will always be compliant with any applicable regulations. In addition to base pay, other compensation, such as an annual bonus or long-term incentive opportunities may be offered.
Our Base Pay Range for this position
€66,000 - €110,000
McKesson has become aware of online recruiting-related scams in which individuals who are not affiliated with or authorized by McKesson are using McKesson’s (or affiliated entities, like CoverMyMeds or RxCrossroads) name in fraudulent emails, job postings or social media messages. In light of these scams, please bear the following in mind:
McKesson Talent Advisors will never solicit money or credit card information in connection with a McKesson job application.
McKesson Talent Advisors do not communicate with candidates via online chatrooms or using email accounts such as Gmail or Hotmail. Note that McKesson does rely on a virtual assistant (Gia) for certain recruiting-related communications with candidates.
McKesson job postings are posted on our career site: careers.mckesson.com.
