Incident Commander – Security Operations

Soho Square Solutions; Chicago (IL); On-site; USD 130,000 - 170,000; Full time

Job summary

Soho Square Solutions is seeking an experienced Incident Commander – Security Operations to lead cybersecurity incident response efforts in a fast-paced environment. You will own and drive incidents from detection to resolution, coordinating cross-functional teams and communicating with senior leadership.

The role demands hands-on leadership, the ability to manage multiple high-severity incidents, and a track record of delivering timely, effective incident resolution.

Qualifications

• 3–4+ years of direct experience leading and commanding cybersecurity incidents in a Security Operations or Incident Response environment.
• Demonstrated experience as Incident Commander during live security incidents with responsibility for coordinating response and driving resolution.
• Strong understanding of end-to-end incident response lifecycle: detection, triage, containment, eradication, recovery, lessons learned.
• Experience coordinating cross-functional technical teams during high-severity security incidents.
• Excellent communication, stakeholder management, prioritization and decision-making, especially in high-pressure situations.
• Hands-on familiarity with security operations and incident response tools such as CrowdStrike, Splunk, ReliaQuest.
• Ability to manage multiple response workstreams with clear ownership, accountability, and status reporting.

Responsibilities

• Lead cybersecurity incidents from detection through post-incident review.
• Serve as central point of coordination during active incidents with clear ownership.
• Coordinate response across Security Operations, Incident Response, IT Infrastructure, Engineering, and others.
• Establish incident priorities, assess business impact, and drive timely resolution.
• Facilitate incident bridges, maintain timelines and action logs, provide status updates to stakeholders.
• Leverage monitoring and IR tools to support investigation and coordination.
• Ensure escalation of critical incidents and maintain communication throughout lifecycle.
• Lead post-incident reviews and document lessons learned.

Skills

Incident Command

Incident Response Leadership

Cross-functional Coordination

Communication Skills

Stakeholder Management

Security Operations

Tools

CrowdStrike

Splunk

ReliaQuest

Job description

We are seeking an experienced Incident Commander – Security Operations to lead and coordinate cybersecurity incident response efforts. The ideal candidate will have a proven track record of directly leading security incidents, coordinating cross-functional response teams, driving incident resolution, and communicating effectively with technical teams and senior leadership.

This role requires someone who has owned and commanded security incidents from initiation through resolution, rather than someone whose experience is limited to supporting incident response activities.

Key Responsibilities

• Lead and manage cybersecurity incidents from detection and initial triage through containment, eradication, recovery, and post-incident review.
• Serve as the central point of coordination during active security incidents, ensuring clear ownership, timely decision-making, and effective communication.
• Coordinate incident response activities across Security Operations, Incident Response, IT Infrastructure, Engineering, and other relevant stakeholders.
• Establish incident priorities, assess business impact, track response actions, and drive teams toward timely resolution.
• Facilitate incident bridges, maintain incident timelines and action logs, and provide regular status updates to technical teams and executive stakeholders.
• Leverage security monitoring and incident response tools to support investigation, response coordination, and incident management.
• Ensure appropriate escalation of critical incidents and maintain clear communication throughout the incident lifecycle.
• Lead post-incident reviews, document lessons learned, and identify opportunities to improve incident response processes and operational readiness.

Required Qualifications

• 3–4+ years of direct experience leading and commanding cybersecurity incidents in a Security Operations or Incident Response environment.
• Demonstrated experience serving as the Incident Commander during live security incidents, with responsibility for coordinating response activities and driving resolution.
• Strong understanding of the end-to-end incident response lifecycle, including detection, triage, containment, eradication, recovery, and lessons learned.
• Experience coordinating cross-functional technical teams during high-severity security incidents.
• Excellent communication, stakeholder management, prioritization, and decision-making skills, particularly in high-pressure situations.
• Hands-on familiarity with security operations and incident response tools such as CrowdStrike, Splunk, and ReliaQuest.
• Ability to manage multiple response workstreams while maintaining clear incident ownership, accountability, and status reporting.

Preferred Qualifications

• Experience in a mature enterprise Security Operations Center (SOC) or incident response function.
• Experience working with executive leadership and providing incident briefings during critical security events.
• Experience improving incident command processes, response playbooks, and operational procedures.