Incident Commander: Cyber IR Lead for Critical Incidents

Thrive; Philippines; Sur place; PHP 900 000 - 1 800 000; Plein temps

Résumé du poste

Thrive in the Philippines is expanding its cybersecurity capabilities and seeks an experienced Incident Commander to lead critical security incident operations across the organization. You will drive containment, eradication, recovery, and client communication with authority, coordinating internal Thrive teams and client stakeholders.

The role requires technical fluency and executive presence to guide multi‑team efforts under pressure.

Qualifications

• Proven incident response experience with leadership of cross-functional security teams.
• Proven success commanding high-impact cybersecurity incidents in a fast-paced, customer-facing environment.
• Strong understanding of attack life cycle stages, investigative workflows, and containment best practices.
• Familiarity with attacker tactics and incident frameworks (MITRE ATT&CK, NIST 800-61).
• Excellent communication skills, with experience briefing clients, executives, and cross-disciplinary teams.

Responsabilités

• Serve as the lead Incident Commander for complex or high-priority cybersecurity incidents, assuming control from initial scoping through post-incident review
• Act as the central coordination point across all parties engaged in security incidents
• Ensure that all internal actions are synchronized, prioritized, and in alignment with client needs and Thrive's incident response methodology
• Set the operational tempo, assign task owners, and communicate timelines, dependencies, and roadblocks in real-time
• Drive incident lifecycle management with a focus on containment, minimizing business disruption, and maintaining security assurance
• Maintain clear, structured communication with client stakeholders and Thrive leadership, including updates on threat actor behavior, system impact, business risk, and required decisions
• Lead conference bridges during incident response, ensuring everyone is aligned and progressing toward resolution
• Approve restoration plans, re-entry conditions, and sequencing to minimize risk of re-compromise
• Serve as the public face of Thrive during a cybersecurity crisis, guiding clients with authority and confidence through incident containment and recovery
• Provide real-time risk assessments and business impact updates to client executive teams, IT leads, and legal stakeholders
• Assist clients in coordination with cyber insurance or legal counsel when applicable
• Advocate for long-term maturity improvements post-incident, helping position Thrive as a trusted partner
• Continually enhance Thrive's playbooks, escalation frameworks, and IR documentation based on lessons learned from real-world incidents
• Lead internal after-action reviews and root cause analysis meetings with technical teams and business units
• Partner with Security Engineering to validate detection coverage and response automation opportunities
• Conduct tabletop with internal Thrive teams to test and improve readiness for various threat scenarios
• Promote a strong, communicative culture of shared accountability and post-incident learning across all Thrive teams

Connaissances

Leadership

Incident Response

Communication

Cross-functional

Decision Making

Multitasking

Threat Frameworks

MITRE ATT&CK

Outils

SIEM

EDR

Forensics

Microsoft 365 Defender

SentinelOne

CrowdStrike

Description du poste

Thrive in the Philippines is expanding its cybersecurity capabilities and seeks an experienced Incident Commander to lead critical security incident operations across the organization. You will drive containment, eradication, recovery, and client communication with authority, coordinating internal Thrive teams and client stakeholders.

The role requires technical fluency and executive presence to guide multi‑team efforts under pressure.