Lead Incident Commander, Detection & Response

OpenAI, Inc.; Sydney; On-site; AUD 210,000 - 320,000; Full time

Job summary

OpenAI, Inc. is seeking an Incident Commander for Detection & Response to lead responses to complex security incidents affecting OpenAI’s IP, customer data, and infrastructure.

You will set priorities, coordinate technical work streams, and guide containment and recovery decisions across time zones, integrating telemetry and detection logic to improve incident response. You will work with security and infrastructure teams on endpoints, identity, cloud, and compute environments, ensuring clear

Qualifications

• Led complex security incidents as incident commander or equivalent
• Make sound decisions with incomplete information and revise as evidence changes
• Coordinate responders across teams and time zones
• Communicate calmly and precisely under pressure with clear updates
• Understand detection engineering, telemetry coverage and validation
• Turn incident lessons into practical improvements to readiness and tooling

Responsibilities

• Run incident command from initial assessment through containment, recovery and closure
• Assign work stream owners and coordinate investigation and recovery
• Drive timely containment and recovery decisions with ownership and risk balance
• Communicate incident status, impact, and next steps to stakeholders
• Manage cross-time-zone handoffs with clear ownership and pending actions
• Improve readiness through exercises, playbooks and post-incident reviews
• Collaborate with detection engineers to close visibility gaps and prioritize automation

Skills

Incident command

Cross-team coordination

Decision making

Stakeholder communication

Telemetry analysis

Detection engineering

Tools

SIEM

Playbooks

Logging

Job description

OpenAI, Inc. is seeking an Incident Commander for Detection & Response to lead responses to complex security incidents affecting OpenAI’s IP, customer data, and infrastructure.

You will set priorities, coordinate technical work streams, and guide containment and recovery decisions across time zones, integrating telemetry and detection logic to improve incident response. You will work with security and infrastructure teams on endpoints, identity, cloud, and compute environments, ensuring clear