Security Incident Response Team Manager

OpenAI

. Hire, coach, and develop incident responders .

Posted 11/12/2026full-timeSan Francisco • California • United StatesMid-LevelSenior💰 $401,000 - $510,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in building and leading security incident response teams, with a strong focus on AI-related threats and incident management. Proficient in developing investigation standards, coordinating with stakeholders, and translating incident evidence into actionable improvements.

Highest-signal resume keywords

Security Incident Response ManagementAI Fluency and AI-First MindsetDeep Investigation ExpertiseClear Communication with StakeholdersActive Full Scope Polygraph Clearance

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident Command LeadershipInvestigation Standards DevelopmentPrototyping Tools and ScriptingIncident Closure ValidationResponse Workflow Improvement

Soft Skills

Coaching and MentoringCandid Feedback DeliveryTimely Decision MakingInfluencing Remediation OwnersClear Documentation of Decisions

Tools & Technologies

OpenAI ModelsKubernetesCloud InfrastructureSecurity Observability ToolsDetection Engineering

Certifications & Qualifications

Active Full Scope Polygraph Clearance

Industry Keywords

Incident ResponseAI-Related ThreatsComplex ThreatsInsider ThreatsOn-Call Operations

Tech Stack

Tools & technologies

CloudKubernetes

About the role

Key responsibilities & impact

Hire, coach, and develop incident responders
Build a security incident response team for evolving AI-related threats
Lead incident command for complex threats to research, products, and infrastructure
Establish incident severity and scope, coordinate investigation workstreams, and evaluate containment options
Build and ship agentic capabilities using OpenAI models for evidence collection, investigation context, response coordination, and bounded response workflows
Integrate tools and data with platform engineers and evaluate accuracy, failure modes, and auditability
Set investigation standards for sophisticated adversaries and insider threats across identity, endpoints, cloud, Kubernetes, and large-scale compute
Reconstruct activity, test hypotheses, preserve evidence, and make uncertainty explicit
Drive incidents to verified closure and validate containment and recovery
Document remaining risk and track corrective actions
Coordinate with engineering, infrastructure, legal, privacy, and other stakeholders
Provide executives with clear updates on impact, uncertainty, decisions, and next steps
Build sustainable on-call coverage, escalation paths, and regional handoffs
Build readiness through playbooks, exercises, escalation paths, and containment options
Translate incident evidence into tested defensive improvements with Detection Engineering, Threat Intelligence, Security Observability, and security platform teams
Measure response quality and effectiveness and prioritize improvements based on incident outcomes and readiness evidence

Requirements

What you’ll need

Experience managing security responders or a closely related technical operations team
Record of hiring, coaching, delivering candid feedback, and helping people grow
Strong AI fluency and an AI-first builder mindset
Experience using models or agents to improve real investigation or response workflows, with validated results
Understanding of AI failure modes, rigorous evaluations, and human judgment
Deep investigation expertise across identity, cloud, host, and infrastructure systems
Ability to prototype tools and write scripts or code
Experience commanding consequential incidents involving capable adversaries
Experience leading technical teams and senior stakeholders from uncertain signals through verified recovery
Ability to make timely, defensible decisions with incomplete information
Clear communication with engineers, executives, and legal or privacy partners
Ability to explain uncertainty and document decision rationale
Experience improving on-call operations, response playbooks, or exercise programs
Ability to prioritize meaningful improvements, influence remediation owners, and verify outcomes
Ability to work from a US office three days per week
Active Full Scope Polygraph clearance (application asks whether the candidate has one; if not applicable, select No)
Background checks administered in accordance with applicable law

Benefits

Comp & perks

Equity
Performance-related bonus(es) for eligible employees
Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts
Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)
401(k) retirement plan with employer match
Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents)
Paid medical and caregiver leave (up to 8 weeks)
Flexible PTO for exempt employees and up to 15 days annually for non-exempt employees
13+ paid company holidays
Multiple paid coordinated company office closures throughout the year
Paid sick or safe time
Mental health and wellness support
Employer-paid basic life and disability coverage
Annual learning and development stipend
Daily meals in offices and meal delivery credits as eligible
Relocation support for eligible employees
Charitable donation matching and wellness stipends may also be provided
Immigration and sponsorship support may be provided based on individual circumstances