Incident Commander

#Runwiththe Pack At  Arctic Wolf, we’re on a mission to end cyber risk. We are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity. More than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence t sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference.

We’re constantly looking for talented people to join the Pack and help us take our performance to the next level. About the Position:

Position Overview Operational Incident Commander responsible for solo commanding service incidents of any severity, including Sev1 and Sev2, from detection through technical resolution and through the postmortem that follows. This is the role that puts hands on the wheel during an active incident: assembling the response team, running the bridge, driving investigation, coordinating remediation in real time, and closing the loop with a postmortem and templated status communications.

Given the size of the Incident Commander team, Level 1 cannot be a narrow, entry-only role; it has to be able to run the full lifecycle of a routine incident independently, including publishing templated status updates and facilitating the postmortem for incidents it personally commanded. What Level 1 does not own is judgment that carries cross organizational visibility: finalizing severity for Sev1/Sev2, deciding on communications that fall outside the standard template, and authoring the formal RCA document sit with Level
2.Primary Responsibilities and Duties Solo command incidents at any severity (Sev1 through Sev4) from detection through technical resolution, including Sev1/Sev2 incidents

Assemble the appropriate response team and lead the command bridge (Zoom, incident channel) for the incident's duration

Monitor and triage incoming incidents using Jira, Zendesk, and Status page; propose an initial severity assessment

Lead technical investigation using Kibana, Grafana, and Unix command line tools to identify probable cause and drive remediation

Gather input from tech leads and subject matter experts on symptoms, fixes, and remediation risk, and drive the incident to technical resolution

Author and publish templated status page and incident updates directly, using existing templates

Document the incident timeline, actions taken, and outcomes in real time in the incident tracking tool

Run the postmortem for incidents using existing templates, and drive resulting action items to closure

Chair COE Review meetings

Follow and execute against existing incident response playbooks; flag gaps or outdated steps to a Level 2 Incident Commander Hand off RCA authorship and any communications that fall outside the standard template to a Level 2 Incident Commander at the appropriate point during, or immediately following, the incident

Escalate incidents that carry ambiguous severity, cross organizational risk, or customer/reputational risk to a Level 2 or Level 3 Incident Commander Key Skills Working knowledge of incident management and monitoring tooling (Jira, Zendesk, Status page, Kibana, Grafana)
Working Unix command line proficiency

Ability to stay calm, decisive, and organized while running a live bridge under time pressure

Structured troubleshooting and technical investigation

Comfort writing clear, templated customer facing status updates and facilitating a structured postmortem meeting

Ability to recognize when a decision exceeds this level's…