Incident Response Lead - Remote IR Commander

Rippling, Inc.; United States; Remote; USD 105,000 - 135,000; Full time

Benefits offered by this job

Medical, dental, vision coverage

401(k) with company match

Paid time off

Tuition and certification reimburse

Job summary

Harbor IT is seeking an experienced Incident Commander to lead live cyber incidents for diverse clients in a remote-US setting. You will triage, scope, and contain events across Microsoft 365, Entra ID, endpoints, and servers, coordinating with in-house SOC analysts and external firms as needed.

You will define escalation paths, produce executive‑level briefing materials, and build the practice with playbooks, timelines, and client‑facing reports.

Qualifications

• 6+ years in cybersecurity, with substantial time spent responding to real intrusions.
• Direct experience acting as the lead on security incidents and guiding IR actions.
• Experience across multiple distinct organizations (consulting/MSSP/MDR/panel DFIR).

Responsibilities

• Serve as incident commander for client security incidents; establish scope and priorities.
• Run triage and initial investigation across Harbor-managed environments (Microsoft 365, Entra ID, AD, endpoints, servers, firewalls).
• Own containment decisions and escalation processes, including credential resets and evidence preservation.
• Brief clients and executives with clear, business-focused findings; coordinate with breach counsel and DFIR firms.
• Maintain and improve incident response playbooks, severity model, and escalation matrix.

Skills

Incident response

IR leadership

Cross-functional coordination

Executive communication

Tabletop exercises

Education

Bachelor's degree in a related field

Tools

Microsoft 365

Entra ID

EDR tooling

SIEM

Job description

Harbor IT is seeking an experienced Incident Commander to lead live cyber incidents for diverse clients in a remote-US setting. You will triage, scope, and contain events across Microsoft 365, Entra ID, endpoints, and servers, coordinating with in-house SOC analysts and external firms as needed.

You will define escalation paths, produce executive‑level briefing materials, and build the practice with playbooks, timelines, and client‑facing reports.