Incident Commander Security Response

Job Summary

Leading the response to complex security incidents, the full-time Incident Commander, Security Response will establish priorities, coordinate technical work streams, and drive containment and recovery decisions in a remote environment.

Key responsibilities

• Run incident command from initial assessment through containment, recovery, and closure, establishing severity and response objectives
• Assign work stream owners and coordinate investigation, containment, and recovery efforts while maintaining a decision log
• Communicate incident status and impact to stakeholders, managing cross-time-zone handoffs with clear ownership

Required qualifications

• Experience leading complex security incidents as an incident commander or equivalent response lead
• Strong understanding of detection engineering, including telemetry coverage and detection logic
• Ability to make sound decisions with incomplete information while balancing urgency and operational impact
• Proficiency in coordinating responders across teams and time zones, resolving conflicting priorities
• Experience in turning incident lessons into practical improvements for response readiness and tooling