Incident Commander – Security Operations

We are seeking an experienced Incident Commander – Security Operations to lead and coordinate cybersecurity incident response efforts. The ideal candidate will have a proven track record of directly leading security incidents, coordinating cross-functional response teams, driving incident resolution, and communicating effectively with technical teams and senior leadership.

This role requires someone who has owned and commanded security incidents from initiation through resolution
, rather than someone whose experience is limited to supporting incident response activities.

• Lead and manage cybersecurity incidents from detection and initial triage through containment, eradication, recovery, and post-incident review.
• Serve as the central point of coordination during active security incidents, ensuring clear ownership, timely decision-making, and effective communication.
• Coordinate incident response activities across Security Operations, Incident Response, IT Infrastructure, Engineering, and other relevant stakeholders.
• Establish incident priorities, assess business impact, track response actions, and drive teams toward timely resolution.
• Facilitate incident bridges, maintain incident timelines and action logs, and provide regular status updates to technical teams and executive stakeholders.
• Leverage security monitoring and incident response tools to support investigation, response coordination, and incident management.
• Ensure appropriate escalation of critical incidents and maintain clear communication throughout the incident lifecycle.
• Lead post-incident reviews, document lessons learned, and identify opportunities to improve incident response processes and operational readiness.

• 3–4+ years of direct experience leading and commanding cybersecurity incidents in a Security Operations or Incident Response environment.
• Demonstrated experience serving as the Incident Commander during live security incidents, with responsibility for coordinating response activities and driving resolution.
• Strong understanding of the end-to-end incident response lifecycle, including detection, triage, containment, eradication, recovery, and lessons learned.
• Experience coordinating cross-functional technical teams during high-severity security incidents.
• Excellent communication, stakeholder management, prioritization, and decision-making skills, particularly in high-pressure situations.
• Hands-on familiarity with security operations and incident response tools such as Crowd Strike, Splunk, and Relia Quest
  .
• Ability to manage multiple response work streams while maintaining clear incident ownership, accountability, and status reporting.

• Experience in a mature enterprise Security Operations Center (SOC) or incident response function.
• Experience working with executive leadership and providing incident briefings during critical security events.
• Experience improving incident command processes, response playbooks, and operational procedures.