Lead Incident Commander - Detection & Response

OpenAI; United States; Remote; USD 250,000 - 350,000; Full time

Job summary

OpenAI, Inc. is seeking an experienced Incident Commander on the Detection & Response team to lead the response to complex security incidents affecting OpenAI’s IP, customer data, and infrastructure.

You will set priorities, coordinate multiple work streams, and guide containment and recovery with clear ownership across time zones. You will work with endpoints, identity, cloud, and compute teams, leveraging telemetry and detection logic to assess evidence and guide improvements through

Qualifications

• Led complex security incidents as incident commander or lead
• Ability to make decisions with incomplete information
• Coordinate responders across teams and time zones
• Communicate status clearly to stakeholders under pressure
• Understand telemetry, detection logic, and evidence-based decisions
• Turn incident lessons into practical improvements

Responsibilities

• Run incident command from initial assessment through containment and recovery
• Assign work-stream owners and coordinate investigation and containment
• Drive timely containment decisions with appropriate owners and risks
• Communicate incident status, impact, and next steps to stakeholders
• Manage cross-time-zone handoffs with clear ownership and actions
• Improve readiness through exercises, playbooks, and post-incident reviews
• Collaborate with detection engineers to close visibility gaps and automate responses

Skills

Incident command

Security incident response

Cross-team coordination

Decision making under uncertainty

Detection engineering understanding

Tools

Telemetry platforms

Security tooling

Job description

OpenAI, Inc. is seeking an experienced Incident Commander on the Detection & Response team to lead the response to complex security incidents affecting OpenAI’s IP, customer data, and infrastructure.

You will set priorities, coordinate multiple work streams, and guide containment and recovery with clear ownership across time zones. You will work with endpoints, identity, cloud, and compute teams, leveraging telemetry and detection logic to assess evidence and guide improvements through