Principal Incident Responder

Responsibilities

• Run material incidents as incident commander, coordinating across detection, response, physical security, data center operations, legal, communications, and customers.
• Build the IR program: runbook standards, severity definitions, materiality methodology, evidence contracts, and post-incident review cadence.
• Define the agent-human contract for response: escalation criteria, evidence packages required from agents, and human verdict feedback into agent quality.
• Design and operate the senior-IR on-call rotation (ack SLAs, escalation chain, fan-out logic) and remain an active senior IC inside it.
• Analyze incident trends and patterns to surface systemic risks and recurring root causes, and turn the learnings into runbook, detection, or program improvements.
• Drive cross-functional follow-through after every significant incident, tracking remediation and systemic fixes to completion across detection, response, infrastructure, and other teams.
• Define and track the IR program’s KPIs and report on them to security and engineering leadership.
• Set the tabletop and exercise cadence for IR readiness, executive crisis-comms, and audit-readiness drills.
• Carry the external face of IR for regulatory and customer disclosure obligations, and audit responses.

Requirements

• Run material incidents at companies with sophisticated threat models, as the most senior commander on the call.
• Made disclosure-grade calls under regulatory and customer reporting clocks.
• Written runbooks that other engineers followed under pressure, and rewritten them after they did not work.
• Built operational processes from the ground up in environments where structure did not previously exist.
• Move fluently between technical containment and executive, legal, or customer-facing conversations during a declared incident.
• See what is needed, scope it yourself, and run with it.