Incident Response Advanced Lead

Job Summary: WHO ARE WE? Lumen Dynamics is the world’s leading live entertainment company, comprised of global market leaders: Ticketmaster, Live Nation Concerts, and Live Nation Media & Sponsorship. Ticketmaster is the global leader in event ticketing with over 620 million tickets sold annually and approximately 10,000 clients worldwide. Live Nation Concerts is the largest provider of live entertainment in the world promoting more than 50,000 events annually for nearly 7,000 artists in 40+ countries. These businesses allow Live Nation Media & Sponsorship to create strategic music marketing programs that connect more than 1,200 sponsors with the 145 million fans that attend Lumen Dynamics events each year. For additional information, visit www.livenationentertainment.com . WHO ARE YOU? Passionate and motivated. Driven, with an entrepreneurial spirit. Resourceful, innovative, forward thinking and committed. At Lumen Dynamics , our people embrace these qualities, so if this sounds like you then please read on! WHAT THIS ROLE WILL DO Incident Command and Coordination Serve as the primary Incident Commander for all high-severity (SEV-1 / SEV-2) cyber incidents, owning the full response lifecycle from declaration through closure under an ICS-aligned model — with the depth to lead simultaneous active incidents without degraded performance. Architect and enforce the incident battle rhythm at an advanced level: establish and adapt sync cadences mid-incident, drive the task board with precision, assign owners and enforce accountability across security engineering, threat hunting, CTI, IT, legal, privacy, comms, and business units — with no ambiguity about who owns what. Translate complex technical findings (MITRE ATT&CK technique chains, kill chain progression, diamond model pivots, attacker TTPs, indicators of compromise and attack) into authoritative situational awareness for non-technical stakeholders, drawing on first-hand knowledge of how these frameworks apply in live environments. Anticipate and eliminate critical path blockers before they become delays: containment actions, evidence preservation, regulatory and contractual notification clocks, scope creep signals, and remediation milestones — with proven instincts built from repeated high-pressure experience. Make independent, time-sensitive decisions on severity classification, scope expansion, external support activation (IR retainer, outside counsel, forensics, cyber insurance), and incident closure criteria. Escalate strategically — not reflexively. Mentor and guide junior IR coordinators and incident commanders in real time during live incidents, building organizational depth without sacrificing response velocity. Executive and Stakeholder Communication Own the executive communication stream at the highest level during incidents: produce polished, defensible written situation reports (sitreps) on a predictable cadence and deliver verbal briefings to CISO, CIO, General Counsel, and C-suite with the confidence and authority of someone who has done it under fire. Produce expert-level stakeholder-tailored messaging with no ramp-up required: deep technical framing for SOC and engineering, risk and financial impact framing for executives, and clear plain-language updates for business partners — adjusting in real time as incident facts evolve. Lead coordination with Legal, Privacy, Corporate Communications, and Investor Relations on external notifications, regulatory filings (SEC 8-K for material cyber incidents, state breach laws, GDPR, HIPAA where applicable), and customer disclosures — navigating competing priorities with sound judgment and legal fluency. Own and deliver board-level reporting on significant incidents, ensuring appropriate privilege protections under counsel direction, with the gravitas and precision that board audiences require. Proactively identify communication gaps and systemic messaging failures in past incidents and develop improved templates, protocols, and training to close them. Documentation and Evidence Discipline Maintain and enforce the authoritative incident timeline standard in real time during response — capturing decisions, actions, owners, timestamps, and supporting artifacts with a level of discipline that withstands legal and regulatory scrutiny. Own chain of custody and evidence handling requirements end-to-end, ensuring forensic artifacts, logs, and investigative outputs are documented to a standard defensible in litigation, regulatory investigation, or law enforcement engagement. Lead after-action reports (AARs) and blameless post-incident reviews that go beyond timeline reconstruction to identify systemic root causes, contributing organizational factors, and corrective actions with owners, due dates, and measurable closure criteria. Continuously mature the IR documentation library — playbooks, runbooks, RACI matrices, escalation paths, contact trees, and communication templates — versi