Incident Commander – Security Operations

Job SummaryWe are seeking an experienced Incident Commander – Security Operations to lead and coordinate cybersecurity incident response efforts. The ideal candidate will have a proven track record of directly leading security incidents, coordinating cross-functional response teams, driving incident resolution, and communicating effectively with technical teams and senior leadership.This role requires someone who has owned and commanded security incidents from initiation through resolution, rather than someone whose experience is limited to supporting incident response activities.Key ResponsibilitiesLead and manage cybersecurity incidents from detection and initial triage through containment, eradication, recovery, and post-incident review.Serve as the central point of coordination during active security incidents, ensuring clear ownership, timely decision-making, and effective communication.Coordinate incident response activities across Security Operations, Incident Response, IT Infrastructure, Engineering, and other relevant stakeholders.Establish incident priorities, assess business impact, track response actions, and drive teams toward timely resolution.Facilitate incident bridges, maintain incident timelines and action logs, and provide regular status updates to technical teams and executive stakeholders.Leverage security monitoring and incident response tools to support investigation, response coordination, and incident management.Ensure appropriate escalation of critical incidents and maintain clear communication throughout the incident lifecycle.Lead post-incident reviews, document lessons learned, and identify opportunities to improve incident response processes and operational readiness.Required Qualifications3–4+ years of direct experience leading and commanding cybersecurity incidents in a Security Operations or Incident Response environment.Demonstrated experience serving as the Incident Commander during live security incidents, with responsibility for coordinating response activities and driving resolution.Strong understanding of the end-to-end incident response lifecycle, including detection, triage, containment, eradication, recovery, and lessons learned.Experience coordinating cross-functional technical teams during high-severity security incidents.Excellent communication, stakeholder management, prioritization, and decision-making skills, particularly in high-pressure situations.Hands-on familiarity with security operations and incident response tools such as CrowdStrike, Splunk, and ReliaQuest.Ability to manage multiple response workstreams while maintaining clear incident ownership, accountability, and status reporting.Preferred QualificationsExperience in a mature enterprise Security Operations Center (SOC) or incident response function.Experience working with executive leadership and providing incident briefings during critical security events.Experience improving incident command processes, response playbooks, and operational procedures.