Incident Commander, Detection & Response

OpenAI

. Lead response to complex security incidents affecting OpenAI’s intellectual property, customer data, and infrastructure .

Posted 11/10/2026full-timeRemote • United StatesMid-LevelSenior💰 $347,000 - $510,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading complex security incident responses, coordinating cross-functional teams, and making informed decisions under pressure. Proficient in establishing response priorities, improving readiness through exercises, and effectively communicating with stakeholders.

Highest-signal resume keywords

Incident Command LeadershipCross-Team CoordinationSecurity FundamentalsDetection Engineering UnderstandingEffective Communication Under Pressure

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseContainment StrategiesRecovery PlanningTelemetry EvaluationEvidence Interpretation

Soft Skills

Decision-MakingDelegationConflict ResolutionCalm Communication

Tools & Technologies

Incident Management ToolsResponse PlaybooksDetection Tools

Certifications & Qualifications

Active Full Scope Polygraph Clearance

Industry Keywords

Security IncidentsIntellectual Property ProtectionCustomer Data SecurityInfrastructure SecurityPost-Incident Reviews

Tech Stack

Tools & technologies

Cloud

About the role

Key responsibilities & impact

Lead response to complex security incidents affecting OpenAI’s intellectual property, customer data, and infrastructure
Establish response priorities and coordinate technical work streams
Drive containment and recovery decisions within agreed authority
Keep stakeholders informed as facts evolve
Work with security and infrastructure teams across endpoints, identity, cloud, and compute environments
Maintain clear ownership and effective handoffs across time zones
Run incident command from initial assessment through containment, recovery, and closure
Establish severity, scope, response objectives, and escalation needs
Assign work stream owners and coordinate investigation, containment, and recovery in parallel
Maintain a decision log and distinguish confirmed facts from assumptions
Communicate incident status, impact, uncertainty, actions underway, and next updates to technical and nontechnical stakeholders
Manage cross-time-zone handoffs with explicit command ownership, current status, outstanding risks, pending decisions, and next actions
Improve response readiness through exercises, playbooks, and post-incident reviews
Track agreed corrective actions with their owners
Partner with detection engineers to evaluate telemetry and detection quality
Close incident-related visibility gaps and prioritize practical response automation

Requirements

What you’ll need

Personally led complex security incidents as incident commander or an equivalent response lead, with clear examples of decisions, delegation, escalation, and outcomes
Ability to make sound decisions with incomplete information and revise them as evidence changes
Ability to balance containment urgency with operational impact
Ability to coordinate responders across teams and time zones, resolve conflicting priorities, and maintain clear ownership during handoffs
Ability to communicate calmly and precisely under pressure
Security and infrastructure fundamentals sufficient to challenge investigation findings and assess containment and recovery options
Understanding of detection engineering, including telemetry coverage, detection logic, false positives and false negatives, and validation
Ability to query and interpret evidence to support response decisions
Ability to turn incident lessons into practical improvements to readiness, playbooks, detection coverage, and response tooling
For US-based candidates, background checks administered in accordance with applicable law
Active Full Scope Polygraph clearance is queried in the application form, but the posting does not state it is required
Willingness to work on-site at a client’s office 5 days a week in Maryland is queried in the application form, but conflicts with the advertised remote role and is not stated as a general job requirement

Benefits

Comp & perks

Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts
Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)
401(k) retirement plan with employer match
Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents)
Paid medical and caregiver leave (up to 8 weeks)
Paid time off: flexible PTO for exempt employees and up to 15 days annually for non-exempt employees
13+ paid company holidays
Multiple paid coordinated company office closures throughout the year for focus and recharge
Paid sick or safe time (1 hour per 30 hours worked, or more, as required by applicable state or local law)
Mental health and wellness support
Employer-paid basic life and disability coverage
Annual learning and development stipend
Daily meals in offices, and meal delivery credits as eligible
Relocation support for eligible employees
Charitable donation matching and wellness stipends may also be provided
Equity
Performance-related bonuses for eligible employees