Incident Operations Commander

Alpaca; San Mateo (CA); Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

Competitive Salary & Stock Options

Health Benefits

New Hire Home-Office Setup: One-time $

Job summary

Alpaca is seeking an experienced Incident Commander to lead high-severity incidents across a global 24x7 roster. You will direct cross-functional responders, set severity, engage the right experts, and ensure rapid, reliable recovery while maintaining clear communications with executives and partners.

You will own the incident lifecycle, from declaration to postmortem, driving blameless learnings and tangible follow-ups to prevent recurrence, with an emphasis on automation and efficient handoffs.

Qualifications

• 4+ years commanding or co-commanding high-severity incidents in a production engineering, SRE or technical operations environment.
• You direct technical responders under pressure without being the person writing the fix.
• You make and defend crisp severity and escalation decisions, and you take charge without waiting to be asked.
• You can read a dashboard and judge for yourself whether impact has actually stopped.
• You communicate clearly with engineers, executives and partner-facing stakeholders.

Responsibilities

• Command incidents end to end from declaration to mitigation.
• Classify and hold the line on severity with rapid re-checks.
• Engage the right people, fast; identify owning team and escalate when needed.
• Hold the bridge, protect responders; be the single source of truth for impact and timing.
• Run warm, high-fidelity handoffs across regions; ensure ownership is clear and updates are timely.
• Close the loop with postmortems and actionable tickets.

Skills

Incident command

Under pressure leadership

Severity judgment

Cross-functional collaboration

AI-assisted automation

Tools

ITIL training

Runbooks

ITIL framework

Job description

Who We Are:

Alpaca is a US-headquartered, global leader in agent-first brokerage infrastructure for stocks, ETFs, options, crypto, fixed income, 24/5 trading, and more.
Amongst our subsidiaries, Alpaca is a licensed financial services company, serving hundreds of financial institutions across 40 countries with our institutional-grade APIs. This includes broker-dealers, investment advisors, wealth managers, hedge funds, and crypto exchanges, totalling over 10 million brokerage accounts.
Our global team is a diverse group of experienced engineers, traders, and brokerage professionals who are working to achieve our mission of opening financial services to everyone on the planet. We're deeply committed to open-source contributions and fostering a vibrant community, continuously enhancing our award-winning, developer-friendly API and the robust infrastructure behind it.
Alpaca is proudly backed by $400 million in funding from top-tier global investors including Portage Ventures, Spark Capital, Tribe Capital, Social Leverage, Horizons Ventures, Opera Tech Ventures, SBI Group, Derayah Financial, Unbound, Peak XV, Elefund, and Y Combinator.
Our Team Members:

We're a dynamic team of 400+ globally distributed members who thrive working from our favorite places around the world, with teammates spanning the USA, Canada, Japan, Hungary, Nigeria, Brazil, the UK, and beyond!
We're searching for passionate individuals eager to contribute to Alpaca's rapid growth. If you align with our core values—Stay Curious, Have Empathy, and Be Accountable—and are ready to make a significant impact, we encourage you to apply.

Role

Serve as the on-duty commander for Alpaca's most critical incidents, directing cross-functional response to restore service quickly, keeping the right people engaged and informed, and making sure every incident leaves behind something the organisation can act on.

You do not fix the outage. You make the response reliable: correct severity, the right engineers in the room, mitigation that does not stall, leaders informed in time, and follow-up work that survives the call.

Things You Get To Do

• Command incidents end to end. Take command from declaration to mitigation, keeping responders focused on stopping customer and partner impact as fast as possible. Run the bridge, keep observers out of the responders' way, and name a stall out loud when you see one.
• Classify and hold the line on severity. Set severity at declaration and re-check it as facts arrive. Risk advises on financial and regulatory materiality; the call is yours.
• Engage the right people, fast. Identify the owning team by service, symptom and blast radius, page them, and expand the responder set the moment the first team is wrong or not enough. When a page goes unanswered, elevate - and elevate the escalation. Bring in the leaders who must make business calls: feature flags, traffic shedding, failover, freeze-or-ship.
• Hold the bridge, and protect the people fixing it. Keep engineering and technical support uninterrupted - questions from stakeholders, partners and executives come to you. Be the single source of truth to the partner communications team on impact, severity and timing: you decide when a status page update or partner contact is needed, they write and send it, and chasing a late or stale update is yours.
• Run follow-the-sun handoffs. Deliver warm, high-fidelity handoffs across regions: current impact and severity, mitigation path and next actions, who is in the room, outstanding decisions, and what must not be dropped. The incoming commander confirms ownership before you step away - command never goes dark at a region boundary.
• Close the loop, on the clock. Maintain the timeline of facts as the incident runs rather than reconstructing it afterwards - in a regulated business that record has to hold up long after the call ends. Once mitigated, make sure a blameless retrospective is scheduled with a named owner and a timebox, and record where the cause sits - that choice sets which follow-up items are mandatory. Every action item needs a real ticket, one named accountable, a priority and a category, delivered inside the agreed service level. If a postmortem produces nothing but low-priority items, treat that as a signal the analysis stopped early and elevate to SRE rather than passing it on.
• Automate the coordination away. Coordination is the part of this job that should eventually belong to a machine. Every manual prompt you send - the update that is due, the question nobody answered, the partner nobody contacted - is a candidate for automation, and the direction we are heading is AI handling the routine so commanders can spend their attention on judgement. You get us there by working to the decision trees, saying where they are wrong, and being honest about which of your instincts are actually rules.

Who You Are (Must-Haves)

• 4+ years commanding or co-commanding high-severity incidents in a production engineering, SRE or technical operations environment.
• You direct technical responders under pressure without being the person writing the fix.
• You make and defend crisp severity and escalation decisions, and you take charge without waiting to be asked. Command means waking senior people at 03:00, interrupting an executive, and telling an experienced engineer to stop what they are doing - with an audience watching. It is a visible, directive role and it needs to be instinctive.
• You can read a dashboard and judge for yourself whether impact has actually stopped.
• You communicate clearly with engineers, executives and partner-facing stakeholders - and you know the difference between briefing the comms function and speaking for the company.
• You are comfortable holding other teams to account in the moment, across a reporting line that is not yours, without turning it into friction.
• You thrive in a follow-the-sun model with clean cross-region handoffs.
• You understand FinTech concepts and the trust stakes of API-driven financial platforms.
• You use AI tools and agentic automation to reduce manual toil and speed up response.
• You will work a regional coverage window as part of a global 24x7 Incident Commander roster.

Who You Might Be (Nice-to-Haves)

• Formal incident command training - ITIL, Major Incident Management or crisis management.
• Experience with modern incident management and on-call platforms.
• You have written severity rubrics, decision trees, escalation matrices, runbooks or incident playbooks.
• You have commanded in game days, tabletop exercises or incident simulations, not only in production.
• You have partnered with problem management or reliability programme functions to roadmap incident follow-ups.
• Online securities trading or capital markets experience, or another regulated, market-hours-sensitive domain.

How We Take Care of You:

• Competitive Salary & Stock Options
• Health Benefits
• New Hire Home-Office Setup: One-time USD $500
• Monthly Stipend: USD $150 per month via a Brex Card

Alpaca is proud to be an equal opportunity workplace dedicated to pursuing and hiring a diverse workforce.

Recruitment Privacy Policy