Incident Management Lead, Data Center Security

Anthropic•Seattle, WA

2d•$290,000 - $365,000•Hybrid

About The Position

Anthropic is building data center campuses globally, managed by operating partners, site vendors, and contracted security services. This role is responsible for building and leading the crisis and incident management program for data center physical security. The program aims to standardize incident definitions, severity levels, response procedures, and reporting across all sites and vendors. This is a program-building role focused on creating a framework that partners adopt and that ensures consistent response, including a 24/7 monitoring and response capability as the program matures. The Lead will also be responsible for running major incidents when they occur, from activation to after-action reviews, and driving continuous improvement.

Requirements

Experience building or substantially rebuilding an incident management or crisis management program, including definitions and severity models.
Experience gaining agreement on definitions and procedures from partners (operators, vendors, internal teams) that are not directly controlled.
Experience driving adoption of a framework through playbooks, training, and exercises.
Experience defining incident metrics and building the reporting behind them.
Knowledge of data centers and physical security in critical infrastructure operations.
Experience running major incidents end-to-end (activation, coordination, communication, stand-down, after-action).
Experience holding vendors or managed services to defined performance standards.
Ability to make severity calls quickly on incomplete information and adjust as facts arrive.
Ability to write clearly under pressure for executive reporting.
Ability to work through influence across sites, vendors, and internal teams.

Nice To Haves

Experience designing incident taxonomies, severity models, or escalation frameworks adopted across multiple organizations or vendors.
Experience running an incident metrics program at scale with dashboards and executive reporting.
Incident command system experience (ICS/NIMS or comparable).
Experience standing up or running a global security operations center (GSOC) or equivalent 24/7 capability.
CPP, PSP, CEM, CBCP, or comparable certifications.
Hyperscaler, major colocation, or critical-infrastructure operator experience.
Business continuity or emergency management program background.
Experience in regulated or high-assurance environments.

Responsibilities

Build and own the global crisis and incident management program for data center physical security.
Define, with partners, incident definitions and severity frameworks, including thresholds, escalation criteria, notification requirements, and decision rights.
Secure cross-functional partner buy-in and establish governance for the incident management framework.
Develop playbooks, training, and exercises to ensure adoption and response readiness across sites and vendors.
Define incident metrics, build reporting dashboards, and manage executive reporting cadence.
Ensure consistency in definitions, procedures, reporting, and escalation triggers across multiple vendors and managed services.
Run major incidents, including activation, coordination, decision support to leadership, and formal stand-down.
Conduct structured after-action reviews, track corrective actions, and feed lessons learned back into the program.
Design and manage an always-on monitoring, escalation, and response capability through managed services and site security vendors.