Incident Commander, Detection & Response - US

OpenAI

5d • $347,000 - $510,000

About The Position

As an Incident Commander on Detection & Response, you will lead responses to complex security incidents affecting OpenAI’s intellectual property, customer data, and infrastructure. You will set response priorities, coordinate technical work streams, drive containment and recovery decisions within agreed authority, and keep stakeholders informed as facts evolve. You will work with security and infrastructure teams across endpoint, identity, cloud, and compute environments, maintaining clear ownership and effective handoffs across time zones. Detection engineering knowledge supports the role: you will use telemetry and detection logic to assess evidence, identify visibility gaps, and guide improvements to incident response effectiveness.

The role also involves improving response readiness through exercises, playbooks, and post-incident reviews; tracking corrective actions; and partnering with detection engineers to evaluate telemetry and detection quality, address incident-related visibility gaps, and prioritize practical response automation.

Requirements

• Personally led complex security incidents as an incident commander or equivalent response lead, with examples of decisions, delegation, escalation, and outcomes.
• Make sound decisions with incomplete information and revise them as evidence changes, balancing containment urgency with operational impact.
• Coordinate responders across teams and time zones, resolve conflicting priorities, and maintain clear ownership during handoffs.
• Communicate calmly and precisely under pressure, including concise stakeholder updates and explicit statements of uncertainty.
• Have security and infrastructure fundamentals sufficient to challenge investigation findings and assess containment and recovery options.
• Understand detection engineering, including telemetry coverage, detection logic, false positives and false negatives, and validation; be able to query and interpret evidence to support response decisions.
• Turn incident lessons into practical improvements to readiness, playbooks, detection coverage, and response tooling.

Responsibilities

• Run incident command from initial assessment through containment, recovery, and closure, establishing severity, scope, response objectives, and escalation needs.
• Assign work stream owners and coordinate investigation, containment, and recovery in parallel; maintain a decision log and distinguish confirmed facts from assumptions.
• Drive timely containment and recovery decisions with appropriate owners, weighing security risk, evidence preservation, and operational impact within agreed decision rights.
• Communicate incident status, impact, uncertainty, actions underway, and the next update to technical and nontechnical stakeholders.
• Manage cross-time-zone handoffs with explicit command ownership, current status, outstanding risks, pending decisions, and next actions.
• Improve response readiness through exercises, playbooks, and post-incident reviews, and track agreed corrective actions with their owners.
• Partner with detection engineers to evaluate telemetry and detection quality, close incident-related visibility gaps, and prioritize practical response automation.

What This Job Offers

• Job Type: Full-time
• Education Level: No Education Listed