Incident Commander, Detection & Response (Security Ops)

Bazeta; Los Angeles (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

OpenAI is seeking an Incident Commander for Detection & Response to lead the response to complex security incidents affecting OpenAI's data, infrastructure, and customers. You will establish severity, coordinate multiple work streams, and drive containment and recovery decisions across time zones.

You'll collaborate with detection engineers to evaluate telemetry, close visibility gaps, and implement practical improvements to readiness and tooling.

Qualifications

• Led complex security incidents as incident commander or equivalent.
• Makes sound decisions with incomplete information and revises as needed.
• Coordinates responders across teams and time zones with clear ownership.
• Communicates calmly under pressure to stakeholders with concise updates.
• Understands telemetry, detection logic, and validation of indicators.
• Translates incident lessons into practical improvements for readiness.

Responsibilities

• Run incident command from initial assessment through containment, recovery and closure.
• Assign work stream owners and coordinate investigation, containment and recovery.
• Maintain a decision log distinguishing facts from assumptions.
• Drive timely containment and recovery decisions with owners and impact assessment.
• Communicate incident status, impact, uncertainty, and next steps to stakeholders.
• Handoff across time zones with clear ownership and next actions.
• Improve readiness through exercises, playbooks, and post-incident reviews.

Skills

Incident Command

Telemetry & Detection

Cross-time-zone coordination

Security incident response

Stakeholder communication

Decision making under uncertainty

Job description

OpenAI is seeking an Incident Commander for Detection & Response to lead the response to complex security incidents affecting OpenAI's data, infrastructure, and customers. You will establish severity, coordinate multiple work streams, and drive containment and recovery decisions across time zones.

You'll collaborate with detection engineers to evaluate telemetry, close visibility gaps, and implement practical improvements to readiness and tooling.