Incident Response, Lead

Location: Remote – TX Department: Enterprise Systems Shift: First Shift Standard Weekly Hours: 40 Summary NOTE: This role carries 24/7 on‑call rotation responsibilities and active incident command expectations during major and critical events. The Incident Response Lead works with IT stakeholders across Cook Children's Health Care System to develop policies, procedures, and risk management activities that efficiently contain and minimize the impact of business interruption due to disasters or information system unavailability. This role performs risk and triage analysis to develop incident response plans and runbooks for the most likely and highest‑impact events affecting the organization. The Lead also assists IT and business stakeholders in testing response plans through downtime scenarios, tabletop exercises, and other readiness activities. Qualifications BS/BA degree in Information Technology, Business Administration, Risk Management or a related field required; in lieu of the degree, a high school diploma and 7 years of experience may be accepted. 4+ years’ experience in incident response management or related field required. Strong knowledge of industry standards and frameworks such as ISO 22301 or NIST SP 800‑34. Strong understanding of project management principles and data technologies. Expert-level knowledge of IT Service Management principles and best practices; knowledge of ITIL preferred. Expert-level ServiceNow experience—incident workflows, ticket quality, auditing, and reporting preferred. Proven ability to lead live incident response under pressure. On‑call availability; experience in 24/7 rotation environments. Strong executive communication and reporting skills. Additional Preferred Qualifications Experience in healthcare IT environments. ITIL 4 Foundation certification or higher. Hands‑on experience building or facilitating DR tabletop exercises. Experience building or auditing runbook libraries. Familiarity with clinical system availability requirements. Responsibilities Participate in a 24/7 on‑call rotation for major and critical incidents. When a Priority 1 event occurs, assume incident command—coordinate cross‑functional bridge calls, drive toward resolution, and maintain stakeholder communication from onset through post‑incident review. Assume incident command for major and critical events. Coordinate IS leadership, business stakeholders, and technical resolvers in real time. Draft impact statements and maintain incident timelines. Manage communication cadence through resolution. Enforce ticket discipline during incidents—accuracy, work note quality, and post‑incident review resolution documentation standards within ServiceNow. Platform Expectations Expert‑level ServiceNow experience highly preferred; use platform as both an operational tool and quality assurance mechanism. Evaluate incident ticket integrity: classification accuracy, impact/urgency, scoring, resolution notes, and root cause documentation. Build and maintain auditing processes to ensure data quality across the incident lifecycle. Monitor SLA compliance and workflow adherence. Extract trend data and produce dashboards and reports for leadership. Enforce incident workflow standards and drive corrective action where gaps exist. Platform competency areas: Incident Management, Ticket Quality Evaluation, Audit & Compliance Workflows, Trend Analysis, SLA Monitoring, platform analytics, Problem Management, Reporting, CMDB Awareness. Equal Opportunity Employer Cook Children's Health Care System is an equal opportunity employer. We offer equal employment opportunities in accordance with applicable federal laws, including but not limited to race, color, religion, sex, age, national origin, physical or mental disability, pregnancy, protected veteran status, genetic information, or any other protected class. #J-18808-Ljbffr CCHCS Cook Children's Health Care System