Incident Commander, Detection & Response - US
OpenAI · US - Remote
About this role
## About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Security team protects OpenAI’s technology, people, and products—building technical solutions with operational execution, and fostering a robust security culture. ## About the Role As an **Incident Commander (Detection & Response)**, you’ll lead responses to complex security incidents impacting **OpenAI’s intellectual property, customer data, and infrastructure**. You’ll set response priorities, coordinate technical work streams, make containment and recovery decisions within agreed authority, and keep stakeholders informed as facts evolve. You’ll collaborate across security and infrastructure teams across **endpoints, identity, cloud, and compute**, ensuring clear ownership and effective handoffs across time zones. **Detection engineering knowledge is a supporting requirement**: you’ll use telemetry and detection logic to assess evidence, identify visibility gaps, and drive improvements that make incident response more effective. ## What You’ll Do - **Run incident command** from initial assessment through containment, recovery, and closure—establishing severity, scope, response objectives, and escalation needs. - **Assign work stream owners** and coordinate investigation, containment, and recovery in parallel; maintain a decision log and clearly separate confirmed facts from assumptions. - **Drive timely containment and recovery decisions** with the appropriate owners, balancing security risk, evidence preservation, and operational impact within decision rights. - **Communicate incident status and impact** (including uncertainty, actions underway, and next update) to technical and nontechnical stakeholders. - **Manage cross-time-zone handoffs** with explicit command ownership, current status, outstanding risks, pending decisions, and next actions. - **Improve response readiness** via exercises, playbooks, and post-incident reviews; track corrective actions to completion. - **Partner with detection engineers** to evaluate telemetry and detection quality, close visibility gaps, and prioritize practical response automation. ## You Might Thrive If You - Have **personally led complex security incidents** as incident commander or equivalent response lead, with examples of decisions, delegation, escalation, and outcomes. - Can make **sound decisions with incomplete information**, revising as evidence changes while balancing containment urgency and operational impact. - Can coordinate responders across **teams and time zones**, resolve conflicting priorities, and maintain clear ownership during handoffs. - Communicate **calmly and precisely under pressure**, including concise updates and explicit uncertainty. - Have strong **security and infrastructure fundamentals** to challenge findings and assess containment/recovery options. - Understand **detection engineering** (telemetry coverage, detection logic, false positives/negatives, validation) and can query/interpret evidence to support response decisions. - Turn incident learnings into practical improvements across readiness, playbooks, detection coverage, and response tooling. ## About OpenAI OpenAI is an AI research and deployment company dedicated to ensuring general-purpose AI benefits all of humanity. OpenAI is an equal opportunity employer and is committed to providing reasonable accommodations for applicants with disabilities. *For full
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.