Lead Incident Commander — Detection & Response

OpenAI, Inc.; Melbourne; On-site; AUD 180,000 - 240,000; Full time

Job summary

OpenAI in Melbourne is seeking an experienced Incident Commander to lead complex security incident responses affecting intellectual property, customer data, and infrastructure. You will establish priorities, coordinate technical work streams, drive containment and recovery decisions, and ensure clear ownership across time zones.

You will work with detection and infrastructure teams across endpoints, identity, cloud, and compute environments, using telemetry and detection logic to assess

Qualifications

• Experience leading major security incidents as incident commander or equivalent.
• Ability to make decisions with incomplete information and adapt as facts emerge.
• Strong communication to technical and non-technical stakeholders.

Responsibilities

• Lead incident command from initial assessment to containment, recovery, and closure with defined severity and objectives.
• Coordinate investigation, containment, and recovery across work streams; maintain a decision log.
• Drive timely containment and recovery decisions with owners, balancing risk and operational impact.
• Communicate incident status to technical and non-technical stakeholders.
• Manage cross-time-zone handoffs with clear ownership.
• Improve readiness via playbooks and post-incident reviews.
• Collaborate with detection engineers to close visibility gaps and guide automation.

Skills

Incident command

Security incident response

Cross-team coordination

Telemetry & detection engineering

Decision-making under uncertainty

Tools

SIEM tooling

Cloud security platforms

Job description

OpenAI in Melbourne is seeking an experienced Incident Commander to lead complex security incident responses affecting intellectual property, customer data, and infrastructure. You will establish priorities, coordinate technical work streams, drive containment and recovery decisions, and ensure clear ownership across time zones.

You will work with detection and infrastructure teams across endpoints, identity, cloud, and compute environments, using telemetry and detection logic to assess