Staff Security Technologist, Incident Commander

What you'll do

• Command the highest severity and most complex security incidents as the single accountable leader during active response.
• Make real-time, high-consequence decisions during on-call rotations to balance speed, risk, and operational impact.
• Perform hands-on technical investigations including log analysis, system interrogation, and root cause validation across complex domains.
• Provide executive-level briefings that translate evolving technical realities into concise updates on risks, tradeoffs, and required decisions.
• Conduct rigorous post-incident analyses to identify systemic causes and drive cross-team remediation with accountable owners.
• Design and lead high-fidelity incident simulations and technical tabletop exercises to expose readiness gaps and validate improvements.
• Develop threat-informed response plans, playbooks, and automated tools to solve recurring classes of security problems.
• Perform "left of boom" threat modeling and pre-mortems to translate attack paths into preventive security controls.

What we're looking for

• 8+ years of experience in security operations, detection, or incident response roles at scale.
• Demonstrated ownership of ambiguous, large, complex, high-impact incidents and multi-team programs.
• Recognized technical domain expertise in incident response and familiarity with modern attacker TTPs.
• Strong technical investigation skills using logs, telemetry, and raw system data to determine root cause.
• Experience briefing executives during active incidents and aligning technical and non-technical stakeholders.
• Experience designing or running technical incident simulations like tabletops or purple team exercises.
• Experience building or leveraging AI-driven tooling to improve incident response posture.
• Ability to script or code in Python, Go, or similar to automate response tasks (preferred).