Incident Commander: Lead Cyber Incident Response

Thrive; Central Luzon; On-site; PHP 1,100,000 - 1,300,000; Full time

Job summary

Thrive is expanding its cybersecurity capabilities and is seeking a highly capable Incident Commander to lead critical security incident operations across our organization.

The Incident Commander will direct containment, eradication, recovery, and client communication with authority, guiding multi‑team efforts under pressure and ensuring alignment with Thrive's incident response methodology.

Qualifications

• Proven incident response experience with leadership of cross-functional security teams.
• Proven success commanding high-impact cybersecurity incidents in fast-paced, customer-facing environments.
• Strong understanding of attack lifecycle stages, investigative workflows, and containment best practices.
• Familiarity with security tools (SIEM, EDR, forensic platforms), system/network architecture, IR methodologies.
• Excellent communication skills, with experience briefing clients, executives, and cross-disciplinary teams.

Responsibilities

• Lead Incident Commander for complex or high-priority cybersecurity incidents.
• Coordinate across all parties engaged in security incidents.
• Ensure actions are synchronized and aligned with client needs and IR methodology.
• Set operational tempo, assign owners, and communicate timelines in real-time.
• Drive incident lifecycle management focusing on containment and minimizing disruption.
• Provide real-time risk assessments to client executives and Thrive leadership.

Skills

Incident response

Leadership

Cross-functional teams

Client communication

Security tools familiarity

Tools

SIEM

EDR

Forensic platforms

Backup & DR

Job description

Thrive is expanding its cybersecurity capabilities and is seeking a highly capable Incident Commander to lead critical security incident operations across our organization.

The Incident Commander will direct containment, eradication, recovery, and client communication with authority, guiding multi‑team efforts under pressure and ensuring alignment with Thrive's incident response methodology.