Incident Commander, Detection & Response

This is a fully remote position, open to applicants in Australia, +4 more countries.

📋 Description

• Oversee the response to intricate security incidents impacting OpenAI's intellectual property, customer information, and infrastructure.

• Set response priorities and synchronize technical work streams.

• Lead decisions on containment and recovery within defined authority.

• Keep stakeholders updated as information develops.

• Collaborate with security and infrastructure teams across endpoints, identity, cloud, and computing environments.

• Ensure clear ownership and effective transitions across time zones.

• Manage incident command from initial assessment through to containment, recovery, and conclusion.

• Define severity, scope, response objectives, and escalation requirements.

• Designate work stream leaders and coordinate investigation, containment, and recovery efforts simultaneously.

• Maintain a decision log, differentiating confirmed facts from assumptions.

• Communicate the status of incidents, impacts, uncertainties, actions in progress, and forthcoming updates to both technical and non-technical stakeholders.

• Handle cross-time-zone transitions with explicit command ownership, current status, outstanding risks, pending decisions, and next steps.

• Enhance response readiness through drills, playbooks, and post-incident evaluations.

• Monitor agreed corrective actions alongside their responsible parties.

• Collaborate with detection engineers to assess telemetry and the quality of detection.

• Address visibility gaps related to incidents and prioritize practical response automation.

⛳️ Requirements

• Demonstrated experience leading complex security incidents as an incident commander or equivalent response leader.

• Clear instances of decision-making, delegation, escalation, and resulting outcomes.

• Capability to make informed decisions with incomplete information and adjust as new evidence emerges.

• Proficiency in coordinating responders across teams and time zones, resolving conflicting priorities, and ensuring clear ownership during transitions.

• Ability to communicate calmly and accurately under pressure.

• Solid understanding of security and infrastructure fundamentals to critically assess investigation findings and evaluate containment and recovery options.

• Knowledge of detection engineering, including telemetry coverage, detection logic, false positives, false negatives, and validation techniques.

• Skill in querying and interpreting evidence to support response decisions.

• Ability to translate lessons learned from incidents into actionable improvements in readiness, playbooks, detection coverage, and response tools.

• Authorization to work in the country where the position is based may be required.

🏝️ Benefits

• Equal opportunity employer.

• Reasonable accommodations available for applicants with disabilities.

• Immigration and sponsorship assistance may be offered based on individual circumstances.

• Background checks conducted in accordance with applicable law.