Incident Commander - CIRT

Thrive; Central Luzon; On-site; PHP 1,100,000 - 1,300,000; Full time

Job summary

Thrive is expanding its cybersecurity capabilities and is seeking a highly capable Incident Commander to lead critical security incident operations across our organization.

The Incident Commander will direct containment, eradication, recovery, and client communication with authority, guiding multi‑team efforts under pressure and ensuring alignment with Thrive's incident response methodology.

Qualifications

• Proven incident response experience with leadership of cross-functional security teams.
• Proven success commanding high-impact cybersecurity incidents in fast-paced, customer-facing environments.
• Strong understanding of attack lifecycle stages, investigative workflows, and containment best practices.
• Familiarity with security tools (SIEM, EDR, forensic platforms), system/network architecture, IR methodologies.
• Excellent communication skills, with experience briefing clients, executives, and cross-disciplinary teams.

Responsibilities

• Lead Incident Commander for complex or high-priority cybersecurity incidents.
• Coordinate across all parties engaged in security incidents.
• Ensure actions are synchronized and aligned with client needs and IR methodology.
• Set operational tempo, assign owners, and communicate timelines in real-time.
• Drive incident lifecycle management focusing on containment and minimizing disruption.
• Provide real-time risk assessments to client executives and Thrive leadership.

Skills

Incident response

Leadership

Cross-functional teams

Client communication

Security tools familiarity

Tools

SIEM

EDR

Forensic platforms

Backup & DR

Job description

About Us

Thrive is a rapidly growing technology solutions provider focusing upon Cloud, Cyber Security, Networking, Disaster Recovery and Managed Services. Our corporate culture, engineering talent, customer-centric approach, and focus upon "next generation" services help us stand out amongst our peers. Thrive is on the look-out for individuals who don't view their weekdays spent at "a job", but rather look to develop valuable skills that ignite their passion and lead to a CAREER. If you're attracted to a "work hard, play hard" environment, seeking the guidance, training and experience necessary to build a lucrative career, then welcome to THRIVE!!

About Us

Thrive is a rapidly growing technology solutions provider focusing upon Cloud, Cyber Security, Networking, Disaster Recovery and Managed Services. Our corporate culture, engineering talent, customer-centric approach, and focus upon "next generation" services help us stand out amongst our peers. Thrive is on the look-out for individuals who don't view their weekdays spent at "a job", but rather look to develop valuable skills that ignite their passion and lead to a CAREER. If you're attracted to a "work hard, play hard" environment, seeking the guidance, training and experience necessary to build a lucrative career, then welcome to THRIVE!!

Position Overview

Thrive is expanding its cybersecurity capabilities and is seeking a highly capable Incident Commander to lead critical security incident operations across our organization. This role is essential for directing and coordinating all activities and resources involved in a security incident, ensuring alignment across internal Thrive teams and with client stakeholders.

The Incident Commander acts as the single point of accountability for the lifecycle of high-severity incidents—driving containment, eradication, recovery, and client communication with authority and clarity. This leader must possess both technical fluency and strong executive presence to guide multi‑team efforts under pressure.

• Serve as the lead Incident Commander for complex or high-priority cybersecurity incidents, assuming control from initial scoping through post-incident review
• Act as the central coordination point across all parties engaged in security incidents
• Ensure that all internal actions are synchronized, prioritized, and in alignment with client needs and Thrive's incident response methodology
• Set the operational tempo, assign task owners, and communicate timelines, dependencies, and roadblocks in real-time
• Drive incident lifecycle management with a focus on containment, minimizing business disruption, and maintaining security assurance
• Maintain clear, structured communication with client stakeholders and Thrive leadership, including updates on threat actor behavior, system impact, business risk, and required decisions
• Lead conference bridges during incident response, ensuring everyone is aligned and progressing toward resolution
• Approve restoration plans, re-entry conditions, and sequencing to minimize risk of re-compromise
• Serve as the public face of Thrive during a cybersecurity crisis, guiding clients with authority and confidence through incident containment and recovery
• Provide real-time risk assessments and business impact updates to client executive teams, IT leads, and legal stakeholders
• Assist clients in coordination with cyber insurance or legal counsel when applicable
• Advocate for long-term maturity improvements post-incident, helping position Thrive as a trusted partner
• Continually enhance Thrive's playbooks, escalation frameworks, and IR documentation based on lessons learned from real-world incidents
• Lead internal after-action reviews and root cause analysis meetings with technical teams and business units
• Partner with Security Engineering to validate detection coverage and response automation opportunities
• Conduct tabletop with internal Thrive teams to test and improve readiness for various threat scenarios
• Promote a strong, communicative culture of shared accountability and post-incident learning across all Thrive teams

Requirements

Qualifications

• Proven incident response experience with demonstrated leadership of cross-functional security teams
• Proven success commanding high-impact cybersecurity incidents in a fast-paced, customer-facing environment
• Strong understanding of attack lifecycle stages, investigative workflows, and containment best practices
• Deep knowledge of modern attacker tactics and incident frameworks (MITRE ATT&CK, Cyber Kill Chain, NIST 800-61)
• Excellent communication skills, with experience briefing clients, executives, and cross-disciplinary teams
• Familiarity with security tools (SIEM, EDR, forensic platforms), system/network architecture, incident response methodologies, and backup and disaster recovery plans
• Ability to multitask and make decisions quickly under pressure

Preferred Experience

• Experience with MSSP coordination, including multi-tenant incident response and customer escalation management
• Familiarity with tools like SentinelOne, Microsoft 365 Defender, Fortinet, CrowdStrike, and similar platforms
• Experience integrating legal, compliance, or insurance considerations into incident decision-making

Preferred Certifications

• GCIH - GIAC Certified Incident Handler
• GCFA - GIAC Certified Forensic Analyst
• GCFE - GIAC Certified Forensic Examiner
• CHFI - Computer Hacking Forensic Investigator
• CISSP, CISM, or other management-level security certifications are a plus