Incident Commander, Detection & Response - US

Details

Security is at the foundation of OpenAI's mission to ensure that artificial general intelligence benefits all of humanity. The Security team protects OpenAI's technology, people, and products. The team is technical in what it builds, operational in how it works, and supports all products and research at OpenAI.

As an Incident Commander on Detection & Response, you will lead responses to complex security incidents affecting OpenAI's intellectual property, customer data, and infrastructure. You will establish response priorities, coordinate technical workstreams, drive containment and recovery decisions within agreed authority, and keep stakeholders informed as facts evolve. You will work with security and infrastructure teams across endpoint, identity, cloud, and compute environments, maintaining clear ownership and effective handoffs across time zones. Detection engineering knowledge is a supporting requirement for using telemetry and detection logic to assess evidence, identify visibility gaps, and guide improvements to incident response.

Responsibilities

• Run incident command from initial assessment through containment, recovery, and closure, establishing severity, scope, response objectives, and escalation needs.
• Assign workstream owners and coordinate investigation, containment, and recovery in parallel.
• Maintain a decision log and distinguish confirmed facts from assumptions.
• Drive timely containment and recovery decisions with appropriate owners, balancing security risk, evidence preservation, and operational impact within agreed decision rights.
• Communicate incident status, impact, uncertainty, actions underway, and the next update to technical and nontechnical stakeholders.
• Manage cross-time-zone handoffs with explicit command ownership, current status, outstanding risks, pending decisions, and next actions.
• Improve response readiness through exercises, playbooks, and post-incident reviews; track agreed corrective actions with their owners.
• Partner with detection engineers to evaluate telemetry and detection quality, close incident-related visibility gaps, and prioritize practical response automation.

Requirements

• Experience personally leading complex security incidents as an incident commander or equivalent response lead, with clear examples of decisions, delegation, escalation, and outcomes.
• Ability to make sound decisions with incomplete information and revise them as evidence changes, balancing containment urgency with operational impact.
• Experience coordinating responders across teams and time zones, resolving conflicting priorities, and maintaining clear ownership during handoffs.
• Ability to communicate calmly and precisely under pressure, including concise stakeholder updates and explicit statements of uncertainty.
• Security and infrastructure fundamentals sufficient to challenge investigation findings and assess containment and recovery options.
• Understanding of detection engineering, including telemetry coverage, detection logic, false positives and false negatives, and validation.
• Ability to query and interpret evidence to support response decisions.
• Ability to turn incident lessons into practical improvements to readiness, playbooks, detection coverage, and response tooling.

Benefits

• Base salary range of $347,000-$510,000 per year, plus equity and performance-related bonuses for eligible employees.
• Medical, dental, and vision insurance, with employer contributions to Health Savings Accounts.
• Pre-tax accounts for health, dependent care, and commuter expenses.
• 401(k) retirement plan with employer match.
• Paid parental, medical, and caregiver leave.
• Paid time off, company holidays, paid office closures, and paid sick or safe time as required by applicable law.
• Mental health and wellness support.
• Employer-paid basic life and disability coverage.
• Annual learning and development stipend.
• Daily meals in offices and eligible meal delivery credits.
• Relocation support for eligible employees.
• Additional taxable fringe benefits may include charitable donation matching and wellness stipends.