Incident Commander, Detection & Response - APAC

About the role

OpenAI's Security team protects its technology, people and products, and is technical in what it builds but operational in how it works. As Incident Commander on Detection & Response, you will lead the response to complex security incidents affecting OpenAI's intellectual property, customer data and infrastructure. The role is remote and based in Australia.

Key responsibilities

• Run incident command from initial assessment through containment, recovery and closure, setting severity, scope, response objectives and escalation needs.
• Assign work stream owners and coordinate investigation, containment and recovery in parallel, keeping a decision log and distinguishing facts from assumptions.
• Drive timely containment and recovery decisions, weighing security risk, evidence preservation and operational impact within agreed decision rights.
• Communicate incident status, impact, uncertainty, actions underway and the next update to technical and non-technical stakeholders.
• Manage cross-time-zone handoffs with clear ownership, current status, outstanding risks, pending decisions and next actions.
• Improve readiness through exercises, playbooks and post-incident reviews, tracking corrective actions with owners.
• Partner with detection engineers to evaluate telemetry and detection quality, close visibility gaps and prioritize response automation.

Required profile

• Has personally led complex security incidents as incident commander or an equivalent response lead, with clear examples of decisions, delegation, escalation and outcomes.
• Makes sound decisions with incomplete information and balances containment urgency with operational impact.
• Coordinates responders across teams and time zones and resolves conflicting priorities.
• Communicates calmly and precisely under pressure, including concise updates and explicit statements of uncertainty.
• Turns incident lessons into practical improvements to readiness, playbooks, detection coverage and response tooling.

Required skills

• Security and infrastructure fundamentals to challenge investigation findings and assess containment and recovery options.
• Detection engineering knowledge: telemetry coverage, detection logic, false positives and false negatives, and validation.
• Ability to query and interpret evidence to support response decisions.