Incident Commander, Detection & Response - APAC

The role

You will lead the response to complex security incidents affecting intellectual property, customer data, and infrastructure. You will establish response priorities, coordinate technical work streams, and drive containment and recovery decisions.

What you will do

• Run incident command from initial assessment through containment, recovery, and closure.
• Assign work stream owners and coordinate investigation, containment, and recovery in parallel.
• Drive timely containment and recovery decisions with the appropriate owners.
• Communicate incident status, impact, uncertainty, actions underway, and the next update to stakeholders.
• Manage cross-time-zone handoffs with explicit command ownership and status updates.
• Improve response readiness through exercises, playbooks, and post-incident reviews.
• Partner with detection engineers to evaluate telemetry and detection quality.

Required qualifications

• Personally led complex security incidents as incident commander or an equivalent response lead.
• Make sound decisions with incomplete information.
• Coordinate responders across teams and time zones.
• Communicate calmly and precisely under pressure.
• Have security and infrastructure fundamentals to challenge investigation findings and assess containment and recovery options.
• Understand detection engineering, including telemetry coverage, detection logic, false positives and false negatives, and validation.
• Can query and interpret evidence to support response decisions.
• Turn incident lessons into practical improvements to readiness, playbooks, detection coverage, and response tooling.

About the company

OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. They push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through their products.