Incident Commander (Detection & Response)

Quick Facts

• Role: Incident Commander, Detection & Response

Description

You will lead the response to complex security incidents impacting intellectual property, customer data, and infrastructure. You’ll set incident priorities and severity, coordinate parallel investigation and containment/recovery work streams, and communicate evolving facts and decisions to stakeholders. You’ll also use telemetry and detection logic to assess evidence, identify visibility gaps, and improve response readiness through playbooks, exercises, and automation.

Responsibilities

• Run incident command from initial assessment through containment, recovery, and closure
• Establish severity, scope, response objectives, and escalation needs
• Assign work stream owners and coordinate investigation, containment, and recovery in parallel
• Maintain a decision log and separate confirmed facts from assumptions
• Drive timely containment and recovery decisions while weighing risk, evidence preservation, and operational impact
• Provide clear incident updates, including uncertainty and next steps
• Manage cross-time-zone handoffs with explicit command ownership and outstanding decisions
• Improve readiness via exercises, playbooks, and post-incident reviews; track corrective actions
• Partner with detection engineers to evaluate telemetry and detection quality and close visibility gaps

Requirements

• Have personally led complex security incidents as incident commander or equivalent response lead with examples of decisions, delegation, escalation, and outcomes
• Make sound decisions with incomplete information and revise them as evidence changes
• Coordinate responders across teams and time zones and resolve conflicting priorities with clear ownership
• Communicate calmly and precisely under pressure with concise stakeholder updates and explicit uncertainty
• Have strong security and infrastructure fundamentals to challenge investigation findings and assess containment/recovery options
• Understand detection engineering: telemetry coverage, detection logic, false positives/false negatives, and validation; can query and interpret evidence
• Turn incident lessons into practical improvements to readiness, playbooks, detection coverage, and response tooling

Benefits

Opportunity to lead high-impact security incident response for environments including endpoints, identity, cloud, and compute.