Director - Enterprise Incident Management (Raleigh, NC/Phoenix, AZ)

Overview

This is a hybrid role with the expectation that time working will regularly take place inside and outside of a company office in Raleigh, NC or Phoenix, AZ.

As First Citizens Bank continues to grow and mature within the Large Financial Institution (LFI) space, we are investing in greater resilience, responsiveness, and operational discipline across our technology and business landscape. The Director of Enterprise Incident Management will lead the enterprise-wide strategy and execution direction of the IT Major Incident Management and Enterprise Incident Management strategy, driving a unified and risk-aware response capability that minimizes business exposure and strengthens our operational resiliency program.

This is a high-impact leadership role responsible for maturing the Enterprise Incident Response Framework, establishing clear governance and process integration across IT and business functions, and ensuring communication and decision-making during high-severity events. This role is responsible for assembling, managing and communicating IT and Non-IT incidents that can negatively impact bank services and or our customers. The Director will collaborate closely with Technology Operations, the Resiliency Office, Crisis Management, Regulatory Affairs, Compliance and Risk partners, to build a culture of readiness, accountability, and continuous improvement.

Operations Oversight - Manages associate teams supporting technical operations and infrastructure. Oversees, develops, and maintains systems, hardware, software, and other technical components crucial to daily operations. Implements methods of reporting and monitoring to track the performance, functionality, and cost-effectiveness of Bank systems. Provides guidance on the resolution of complex technical issues.

Business Strategy - Matches technical operations and infrastructure activities with developing organizational needs. Develops strong relationships with business partners and service providers. Leads team strategies and initiatives.

Managerial Functions - Establishes and monitors expectations to achieve company and department goals. Responsible for budget and resource allocation. Makes appropriate changes to IT policies, standards, procedures, and efficiencies in order to meet objectives. Manages the performance, training, and evaluation of assigned staff. Maximizes department achievements by providing professional development.

Technical Expertise - Serves as a technical expert and strategic leader to senior management, associates, and business units. Maintains a strong knowledge of industry trends, technology, and vendor offerings. Ensures that the Bank’s technical infrastructure complies with all appropriate configuration and security standards, and that IT service levels are met.

Responsibilities

Strategic leadership:

• Lead the Enterprise Incident Management and Major Incident Management functions, overseeing both daily execution and long term process maturity.
• Continue to define and implement the Enterprise Response Framework, ensuring alignment with ITIL-based ITSM processes, operational resilience principles, and regulatory expectations for a large financial institution.
• Partner with Risk, Technology, and Business Continuity leaders to ensure incident response integrates seamlessly with the broader resilience strategy.

Resiliency through Response:

• Build and sustain organizational resilience through effective, consistent incident response mechanisms that prioritize restoration, containment, and recovery.
• Ensure that lessons learned from incidents directly inform risk mitigation, preventative controls, and business continuity planning.
• Enhance and develop scenario response playbooks to provide repeatable and consistent processes.
• Champion the use of data, automation, and simulation exercises to strengthen recovery readiness and reduce systemic vulnerabilities.
• Conduct periodic desktop session with core response teams to provide muscle memory engagements and responsibilities during incidents.

Risk Based Decision Making & Exposure Reduction

• Drive risk-informed incident management by enabling leaders to make timely, evidence-based decisions during disruptions.
• Lead efforts to reduce overall exposure from incidents – minimizing customer impact, financial loss, and reputational risk through proactive escalation, communication, and governance.

Operational Excellence & Communication

• Direct the enterprise’s response to high-severity incidents, including real-time coordination of technical teams, vendors, and business stakeholders.
• Oversee executive and enterprise communications during significant incidents, ensuring consistent, transparent, and timely updates.
• Partner with Problem, Change, and Event Management owners to ensure process integration and data integrity across the ITSM ecosystem.
• Translate technical impact to clear business context, enabling executives to understand risk tradeoffs to prioritize response actions.
• Define and measure KPIs such as Mean Time to Detect (MTTD), Mean Time to Restore (MTTR), and overall business impact duration, using insights to drive continual service improvement.

Leadership & Team Development

• Build and lead a high-performing Enterprise Incident Management team that operates with precision, composure, and strategic clarity during critical events.
• Develop talent, define roles and competencies, and foster a culture of collaboration, continuous learning, and operational resilience.
• Serve as a visible leader and a trusted advisor to senor technology and business executives during crisis and recovery efforts.

Qualifications

Bachelor's Degree and 8 years of experience in Complex leadership and management responsibilities in an Infrastructure and Operations Enterprise environment OR High School Diploma or GED and 12 years of experience in Complex leadership and management responsibilities in an Infrastructure and Operations Enterprise environment

Preferred skills:

• Strong experience in ServiceNow, particularly with ITSM modules
• Proven leadership experience, particularly in a financial institution
• Strategic thinker with strong operational execution skills and executive presence.
• Exceptional facilitation and communication abilities under pressure.
• Deep understanding of risk management, business impact assessment, and resiliency frameworks.
• Skilled in synthesizing technical detail into business context for senior leadership.
• Proven record of transforming processes, developing talent, and driving measurable service improvement.

Preferred certifications:

• ITIL v4 Intermediate or Managing Professional Certification
• Certified Incident Manager (BCI, DRII, or equivalent)
• Additional certifications in SRE, Operational Resilience, or Program Management (PMP, CISM, or similar) are considered a plus

Benefits are an integral part of total rewards and First Citizens Bank is committed to providing a competitive, thoughtfully designed and quality benefits program to meet the needs of our associates. More information can be found at benefits.

Strategic leadership:

• Lead the Enterprise Incident Management and Major Incident Management functions, overseeing both daily execution and long term process maturity.
• Continue to define and implement the Enterprise Response Framework, ensuring alignment with ITIL-based ITSM processes, operational resilience principles, and regulatory expectations for a large financial institution.
• Partner with Risk, Technology, and Business Continuity leaders to ensure incident response integrates seamlessly with the broader resilience strategy.

Resiliency through Response:

• Build and sustain organizational resilience through effective, consistent incident response mechanisms that prioritize restoration, containment, and recovery.
• Ensure that lessons learned from incidents directly inform risk mitigation, preventative controls, and business continuity planning.
• Enhance and develop scenario response playbooks to provide repeatable and consistent processes.
• Champion the use of data, automation, and simulation exercises to strengthen recovery readiness and reduce systemic vulnerabilities.
• Conduct periodic desktop session with core response teams to provide muscle memory engagements and responsibilities during incidents.

Risk Based Decision Making & Exposure Reduction

• Drive risk-informed incident management by enabling leaders to make timely, evidence-based decisions during disruptions.
• Lead efforts to reduce overall exposure from incidents – minimizing customer impact, financial loss, and reputational risk through proactive escalation, communication, and governance.

Operational Excellence & Communication

• Direct the enterprise’s response to high-severity incidents, including real-time coordination of technical teams, vendors, and business stakeholders.
• Oversee executive and enterprise communications during significant incidents, ensuring consistent, transparent, and timely updates.
• Partner with Problem, Change, and Event Management owners to ensure process integration and data integrity across the ITSM ecosystem.
• Translate technical impact to clear business context, enabling executives to understand risk tradeoffs to prioritize response actions.
• Define and measure KPIs such as Mean Time to Detect (MTTD), Mean Time to Restore (MTTR), and overall business impact duration, using insights to drive continual service improvement.

Leadership & Team Development

• Build and lead a high-performing Enterprise Incident Management team that operates with precision, composure, and strategic clarity during critical events.
• Develop talent, define roles and competencies, and foster a culture of collaboration, continuous learning, and operational resilience.
• Serve as a visible leader and a trusted advisor to senor technology and business executives during crisis and recovery efforts.

Bachelor's Degree and 8 years of experience in Complex leadership and management responsibilities in an Infrastructure and Operations Enterprise environment OR High School Diploma or GED and 12 years of experience in Complex leadership and management responsibilities in an Infrastructure and Operations Enterprise environment

Preferred skills:

• Strong experience in ServiceNow, particularly with ITSM modules
• Proven leadership experience, particularly in a financial institution
• Strategic thinker with strong operational execution skills and executive presence.
• Exceptional facilitation and communication abilities under pressure.
• Deep understanding of risk management, business impact assessment, and resiliency frameworks.
• Skilled in synthesizing technical detail into business context for senior leadership.
• Proven record of transforming processes, developing talent, and driving measurable service improvement.

Preferred certifications:

• ITIL v4 Intermediate or Managing Professional Certification
• Certified Incident Manager (BCI, DRII, or equivalent)
• Additional certifications in SRE, Operational Resilience, or Program Management (PMP, CISM, or similar) are considered a plus

Benefits are an integral part of total rewards and First Citizens Bank is committed to providing a competitive, thoughtfully designed and quality benefits program to meet the needs of our associates. More information can be found at benefits.