Incident Responder (AI Training)

DataAnnotation; New Zealand; Remote; NZD 69,000 - 172,000; Full time

Job summary

DataAnnotation is seeking an Incident Responder to assess how models handle detection, triage, forensics, and containment during real incidents. You will evaluate reasoning, identify gaps, and report findings to trusted responders.

Responsibilities include catching misreads, persistence issues, and broken chain of custody, then writing playbooks grounded in real-world incident unfoldings. Remote, project-based, English proficiency required.

Qualifications

• Hands-on experience in incident response, DFIR, or SOC operations.
• Comfort with logs, forensic artifacts, and intrusion timelines.
• Clear written English; explanations as training signals.
• No degree required; focus on ability over credentials.

Responsibilities

• Pressure-test the response reasoning across detection, triage, forensics, and containment.
• Catch the costly mistakes: misread logs, missed persistence, broken chain of custody.
• Write the correct playbook when the model falls short, grounded in real incidents.

Skills

Incident response

DFIR

SOC operations

Log analysis

Written English

Education

No degree required

Job description

Overview

During an incident, models love a tidy story: one root cause, a clean timeline, a confident containment plan. Real intrusions are messier, and a model that misreads a log or clears an attacker too early does real damage. Someone has to catch that, and that someone is you.

As an Incident Responder you'll grade how models handle detection, triage, forensics, and write the analysis a seasoned responder would trust.

What you’ll actually do

• Pressure-test the response reasoning across detection, triage, forensics, and containment, and see where the model jumps to conclusions.
• Catch the costly mistakes: misread logs, missed persistence, broken chain of custody, and containment that tips off the attacker.
• Write the correct playbook when the model falls short, grounded in how real incidents actually unfold.

Roles this fits

Common backgrounds: Incident Responder, DFIR Analyst, SOC Engineer.

What we look for

• Hands-on experience in incident response, DFIR, or SOC operations.
• Comfort with logs, forensic artifacts, and the timeline of a real intrusion.
• Clear written English: your explanations are the training signal.
• No degree required. We care about what you can do, not where you learned it.

Compensation

Up to $125+/hr depending on task difficulty and specialization. Many contributors add $100k–$200k a year; some make it their full-time income.

About DataAnnotation

DataAnnotation is where 1M+ experts train the world’s leading AI models. Hundreds of millions paid to contributors to date, and the average contributor stays 5+ years. Flexible, remote, and always project-available.