• Run incident command from initial assessment through containment, recovery, and closure, establishing severity, scope, response objectives, and escalation needs.
• Assign work stream owners and coordinate investigation, containment, and recovery in parallel. Maintain a decision log and distinguish confirmed facts from assumptions.
• Drive timely containment and recovery decisions with the appropriate owners, weighing security risk, evidence preservation, and operational impact within agreed decision rights.
• Communicate incident status, impact, uncertainty, actions underway, and the next update to technical and nontechnical stakeholders.
• Manage cross-time-zone handoffs with explicit command ownership, current status, outstanding risks, pending decisions, and next actions.
• Improve response readiness through exercises, playbooks, and post-incident reviews; track agreed corrective actions with their owners.
• Partner with detection engineers to evaluate telemetry and detection quality, close incident-related visibility gaps, and prioritize practical response automation.
• Have personally led complex security incidents as incident commander or an equivalent response lead, with clear examples of decisions, delegation, escalation, and outcomes.
• Make sound decisions with incomplete information and revise them as evidence changes, balancing containment urgency with operational impact.
• Coordinate responders across teams and time zones, resolve conflicting priorities, and maintain clear ownership during handoffs.
• Communicate calmly and precisely under pressure, including concise stakeholder updates and explicit statements of uncertainty.
• Have the security and infrastructure fundamentals to challenge investigation findings and assess containment and recovery options.
• Understand detection engineering, including telemetry coverage, detection logic, false positives and false negatives, and validation. Can query and interpret evidence to support response decisions.
• Turn incident lessons into practical improvements to readiness, playbooks, detection coverage, and response tooling.