{ "count" : 124326, "data" : [ { "id" : "6a2ce89374d8ee00a0a6b327", "title" : "Incident and Escalation Manager", "company" : "Vapi", "industry" : "Engineering, Product & Design", "salary" : { "min" : 180000.0, "max" : 250000.0, "currency" : "USD", "frequency" : "Yearly" }, "location" : "San Francisco", "locations" : [ "San Francisco" ], "timestamp" : "2026-06-15T07:14:55.204", "fingerprint" : "60c917ee3c64b5678f66ce6a86c18e0c6ac5a4b02e9a8a6aa640d0caadd520e0", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/vapi/f07ff2a1-8b8a-4769-ab0d-dea7cc7ad3a7/application", "externalId" : "f07ff2a1-8b8a-4769-ab0d-dea7cc7ad3a7", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San Francisco", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "37.7879363,-122.4075201" } ], "locationText" : "San Francisco, California, United States", "employmentType" : "FULL_TIME", "experienceLevel" : "Manager", "technicalSkills" : "PagerDuty, Incident.io, Opsgenie", "professionalSkills" : [ "Process management", "Cross-functional coordination", "Vendor management", "Stakeholder management", "Operational metrics", "Resource planning", "Continuous improvement" ], "hardSkillsList" : [ "Incident response", "Escalation management", "Root cause analysis", "Service level agreements", "Customer communication", "Credit process governance", "Metrics reporting", "Partnership building", "Customer RCA", "Post-incident review", "Executive escalation list", "Pattern spotting" ], "softSkillsList" : [ "Leadership", "Critical thinking" ], "hardSkills" : [ { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Escalation management", "level" : "intermediate" }, { "name" : "Root cause analysis", "level" : "intermediate" }, { "name" : "Service level agreements", "level" : "intermediate" }, { "name" : "Customer communication", "level" : "intermediate" }, { "name" : "Credit process governance", "level" : "intermediate" }, { "name" : "Metrics reporting", "level" : "intermediate" }, { "name" : "Partnership building", "level" : "intermediate" }, { "name" : "Customer RCA", "level" : "intermediate" }, { "name" : "Post-incident review", "level" : "intermediate" }, { "name" : "Executive escalation list", "level" : "intermediate" }, { "name" : "Pattern spotting", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" }, { "name" : "Critical thinking" } ], "majorSkills" : "Incident management, Escalation management, Program building", "majorSkillsList" : [ "Incident management", "Escalation management", "Program building" ], "coreResponsibilities" : "Define incident criteria, Author severity model, Design live incident process, Write incident process documentation, Build incident commander rotation, Train incident commander rotation, Balance hiring and utilizing resources, Own pager rotation, Command incidents during shifts, Step down pager share, Own rotation operations, Stand up incident tooling, Set up on-call, Build customer communication templates, Govern customer credit process, Approve financial decisions, Stand up metrics, Report monthly metrics, Build standing partnerships, Train go-to-market teams, Train support teams, Train customer success teams, Train engineering teams, Build feedback loop, Shape engineering roadmap, Own customer-facing RCA, Translate engineering root cause, Ship RCA within SLA, Run blameless post-incident review, Drive action items to closure, Close loop with customers, Hold high-severity issues, Run executive escalation list, Keep owner on escalation, Spot patterns across customers, Force patterns into engineering, Force patterns into product, Be single point of contact, Partner with account team, Build cross-functional recovery plan, Keep written handoff, Keep named deputy", "teamCollaboration" : "Partnerships with engineering; Partnerships with support; Partnerships with CTO office; Partnerships with legal; Partnerships with security; Partnerships with comms; Partnerships with carrier operations; Partner with account team", "projectManagementSkills" : [ "Incident program management", "Escalation program management" ], "domainKnowledge" : "Infrastructure company; Telephony company; Platform company; Carrier dependency; Voice AI infrastructure", "domainList" : [ "infrastructure-company", "telephony-company", "platform-company", "carrier-dependency", "voice-ai-infrastructure" ], "domainSpecificKnowledge" : [ "Infrastructure company", "Telephony company", "Platform company", "Carrier dependency", "Voice AI infrastructure" ], "toolProficiency" : [ "PagerDuty", "Incident.io", "Opsgenie", "Slack", "Status page" ], "communicationSkills" : "Customer communication; Executive presentations; Customer RCA", "documentationSkills" : "Write incident process; Write RCA; Build runbook library", "problemSolvingSkills" : "Decision-making; Root cause analysis; Troubleshooting", "specialRequirements" : "On-call rotation, Off-hours shifts", "outcomesObjectives" : "Protect engineering from noise; Ensure consistent response; Protect renewals; Protect engineering focus; Protect executive confidence; Build scalable program; Resolve incidents; Hold relationship; Track action items to closure; Protect revenue", "qualificationsBasic" : "8 to 12 years experience, Incident management experience, Escalation management experience, Technical support escalations experience, Technical program management experience, Building incident program from zero, Owning incident program growth, Standing up incident commander rotation, Calm under pressure, Decision-making with incomplete information, Clear writing under pressure, Comfort with technical depth, Willingness to work rotation", "qualificationsPreferred" : "Experience hiring a team is a plus, Familiarity with telephony is a plus, Familiarity with carrier dynamics is a plus, Familiarity with real-time systems is a plus", "remoteFriendly" : true, "rawDescription" : "Voice AI that resolves, not transfers. Most phone systems trap callers in menus and scripts. Vapi is the platform for deploying voice agents that know your business and can listen, adapt, and resolve in minutes. - The numbers: 1 billion calls. 1 million developers. 10x enterprise ARR growth - The customers: Amazon Ring, ServiceTitan, New York Life, Intuit, Kavak, and thousands more, from YC startups to the Fortune 500 - The news: a $50M Series B led by Peak XV Partners, with Bessemer Venture Partners, Kleiner Perkins, M12 (Microsoft's Venture Fund), Y Combinator, and our earlier backers. Total raised: $72M Incident and Escalation Manager Why this role exists Vapi runs voice AI infrastructure at tens of millions of minutes a month for enterprise customers who route business-critical traffic through us. When something breaks, it breaks in real time, in front of a customer's own customers, and often through a carrier dependency we don't fully control. Today the response is run by whoever is in the Slack thread. That works once. It does not scale, and it costs us renewals, engineering focus, and executive confidence every time it happens. This is the first dedicated hire for the function, and the job is to build it. You will design the program that runs our incident response, train the people who command incidents, and own the customer relationship through the weeks that follow a serious one. You own the pager and you work part of the rotation yourself, because the fastest way to build a program that works is to run inside it while you build it. You are not the engineer fixing the system. You are the person who builds the system so a trained bench can run it, and who takes a real turn on the pager. Building the program This is the core of the role. - Define what counts as an incident and what does not, with entrance and exit criteria that protect engineering from noise. - Author the severity model with response-time targets per level, so a SEV0 means the same thing Monday morning and Friday night. - Design how a live incident runs: the command structure, the update cadence, the single source of truth, the decision rights, and when the call gets escalated past the commander. Write it down so anyone on rotation runs it the same way. - Build and train the incident commander rotation. Build a realistic balance of hiring and utilizing existing resources across humans and AI to stand up the rotation. - Own the pager and work part of the rotation yourself - personally commanding incidents during your shifts and stepping your share down as the bench matures and proves out. Own how the rotation runs regardless of whose shift it is. - Stand up the incident tooling and on-call setup: paging, escalation policies, incident channels, status page, and the runbook library. - Build customer communication templates for each severity and channel, pre-approved so they are not written from scratch under pressure. - Govern the customer credit process with a clear approval chain, so financial decisions stop happening in ad hoc threads. - Stand up the metrics: resolution time, response velocity, escalation volume, RCA SLA adherence, and revenue protected. Report monthly in terms execs use to make resource decisions. - Build standing partnerships with engineering, support, the office of the CTO, legal, security, comms, and carrier operations before the next critical situation. - Train go-to-market, support, customer success, and engineering on where to bring customer-critical issues and how the function works. - Build a feedback loop so incident and escalation data shapes the engineering roadmap instead of dying in postmortems. After the incident - Own the customer-facing RCA. Translate engineering root cause into plain language that tells the truth and holds the relationship. Ship it within the SLA we commit to. - Run the blameless post-incident review. Drive action items to named owners with dates, and track them to closure instead of letting them die in a doc. - Close the loop with affected customers directly, including the credits or commitments made during the incident. Escalation management - Hold the high-severity customer issues that do not rise to a full incident but threaten a renewal or a relationship. - Run the standing executive escalation list. Keep an owner, a next step, and a date on every item. - Spot patterns across customers that no single team owns, and force them into engineering or product as prioritized work. - Be the single point of contact for a regulated customer or a regulatory inquiry that surfaces weeks after the technical fix. - Partner with the account team on at-risk accounts driven by reliability, and build the cross-functional recovery plan. - Keep a written handoff and a named deputy so escalations stay covered when you are out. What you bring - 8 to 12 years across incident management, escalation management, technical support escalations, or technical program management, ideally at an infrastructure, telephony, or platform company operating at scale. - A track record building an incident and escalation program from zero, or owning a meaningful piece of one through its growth, including standing up an incident commander rotation rather than being the sole responder. Experience hiring a team is a plus. - Hands-on familiarity with incident tooling such as PagerDuty, incident.io http://incident.io, Opsgenie, or equivalent, and the Slack and status-page workflows around them. - Calm under pressure as a learned discipline. Gravitas to direct a response and the willingness to remove a distraction from a call even when it outranks you. - Decision-making with incomplete information, and the judgment to know when to escalate and how to do it without losing time. - Clear writing under pressure. You can produce a clean read of a live situation for a senior leader, and a customer RCA that holds a relationship together. - Comfort with technical depth. You do not need to write the fix, but you need to follow the conversation, ask the right question, and know when an answer does not add up. Familiarity with telephony, carrier dynamics, or real-time systems is a strong plus. - Willingness to work part of the incident commander rotation, including off-hours shifts, especially in the first year.", "summaryDescription" : "Incident and Escalation Manager at Vapi. Skills: Incident management, Escalation management, Program building. Define incident criteria. Author severity model", "createdAt" : "2026-06-14T04:46:08.267", "lastUpdated" : "2026-06-15T07:14:55.204", "ingestTimestamp" : "2026-06-14T04:46:08.267", "mongoId" : "6a2ce89374d8ee00a0a6b327", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 180000, "salaryAnnualMax" : 250000, "salaryBand" : "150k-200k", "hasSalary" : true, "allSkills" : [ "Incident response", "Escalation management", "Root cause analysis", "Service level agreements", "Customer communication", "Credit process governance", "Metrics reporting", "Partnership building", "Customer RCA", "Post-incident review", "Executive escalation list", "Pattern spotting", "Leadership", "Critical thinking", "Incident management", "Program building", "Process management", "Cross-functional coordination", "Vendor management", "Stakeholder management", "Operational metrics", "Resource planning", "Continuous improvement", "Incident program management", "Escalation program management", "Infrastructure company", "Telephony company", "Platform company", "Carrier dependency", "Voice AI infrastructure", "PagerDuty", "Incident.io", "Opsgenie", "Slack", "Status page" ], "skillCount" : 35, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Senior", "dataQualityScore" : 0.8888889, "_score" : 1382.2712, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a306fd5f292fd229cfed7df", "title" : "Security Incident Response Manager", "company" : "Stripe", "industry" : "FinTech", "salary" : { "min" : 110000.0, "max" : 150000.0, "currency" : "EUR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market data for a Manager-level Security Incident Response Manager in the FinTech industry in Ireland, adjusted for seniority and company size." }, "location" : "Ireland Locations", "locations" : [ "Ireland Locations" ], "timestamp" : "2026-06-16T11:17:32.753", "fingerprint" : "5f1795380bd689254fa4ec13a24c81721330e837ac870f097537d3dd799086da", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://stripe.com/jobs/search?gh_jid=8007205", "externalId" : "8007205", "industryFunction" : { }, "structuredLocations" : [ { "country" : "Ireland", "continent" : "eu", "workMode" : "onsite" } ], "locationText" : "Ireland", "experienceMinYears" : 5, "experienceLevel" : "Manager", "technicalSkills" : "Python, SQL, MacOS, Linux, Windows", "professionalSkills" : [ "Security management", "Data analytics", "Network security", "Digital forensics", "Incident response", "Threat intelligence", "Data processing", "Data analysis" ], "hardSkillsList" : [ "Incident response", "Threat analysis", "Forensic investigation", "Data analysis", "Network security", "System administration" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Threat analysis", "level" : "intermediate" }, { "name" : "Forensic investigation", "level" : "intermediate" }, { "name" : "Data analysis", "level" : "intermediate" }, { "name" : "Network security", "level" : "intermediate" }, { "name" : "System administration", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident Response Management, Security Operations, Team Leadership, Threat Analysis", "majorSkillsList" : [ "Incident Response Management", "Security Operations", "Team Leadership", "Threat Analysis" ], "coreResponsibilities" : "Leverage security management experience, Improve incident response capabilities, Manage team of security analysts, Manage investigators, Manage responders, Hire team members, Train team members, Evaluate team performance, Provide technical guidance, Develop response procedures, Ensure timely resolution of casework, Collaborate with internal stakeholders, Make continuous improvements to incident response function, Lead team of security analysts, Support team of security analysts, Triage threats, Assess threats, Respond to threats, Provide technical guidance to team, Influence organizational mission, Influence organizational vision, Ensure prioritization of project work, Ensure delivery of project work, Align project work with security roadmaps, Strengthen KPIs for response operations, Strengthen metrics for response operations, Provide clear reporting to stakeholders, Provide consistent reporting to stakeholders, Work cross-functionally with security engineering teams, Gather requirements for analyzing security events data, Gather requirements for responding to security events data, Protect Stripe networks, Protect Stripe systems, Protect Stripe data, Develop strategies for incident response, Document strategies for incident response, Implement strategies for incident response, Develop runbooks for incident response, Document runbooks for incident response, Implement runbooks for incident response, Develop capabilities for incident response, Document capabilities for incident response, Implement capabilities for incident response, Continuously improve security processes, Continuously improve response capabilities, Collaborate with security engineers, Collaborate with security analysts, Coach individual contributors, Mentor individual contributors, Enable career development, Champion quality standards within team", "teamCollaboration" : "Cross-functional teams; Security Analytics teams; Detection teams; Security engineering teams", "projectManagementSkills" : [ "Roadmap planning" ], "domainKnowledge" : "Threat actor tactics; Threat actor techniques; Threat actor procedures; Security incident response; Network security; Digital forensics; Data analytics", "domainList" : [ "threat-actor-tactics", "threat-actor-techniques", "threat-actor-procedures", "security-incident-response", "network-security", "digital-forensics", "data-analytics" ], "domainSpecificKnowledge" : [ "Threat actor tactics", "Threat actor techniques", "Threat actor procedures", "Security incident response", "Network security", "Digital forensics", "Data analytics" ], "toolProficiency" : [ "Chronicle", "Tines", "Osquery", "Splunk" ], "communicationSkills" : "Operational reporting; Incident reporting", "documentationSkills" : "Response procedures; Runbooks", "problemSolvingSkills" : "Root cause analysis", "outcomesObjectives" : "Ensure timely and effective resolution of casework", "qualificationsBasic" : "5+ years leading Security Operations or Incident Response teams, Hands-on, technical management experience, B.S. or M.S. Computer Science or related field, Equivalent experience in Security, Experience recruiting, growing, and leading technical teams, Performance management experience, Excellent written and verbal communication skills, Ability to develop and deliver operational or incident-related information to leadership, Advanced knowledge of data analytics, Advanced knowledge of network security, Advanced knowledge of digital forensics, Advanced knowledge of incident response investigations, Experience with Python, Experience with SQL, Familiarity with macOS, Familiarity with Linux, Familiarity with Windows, Understanding of threat actor TTPs", "qualificationsPreferred" : "Broad knowledge across information security domain, Familiarity with endpoint security, Familiarity with email security, Familiarity with network security, Familiarity with identity management, Familiarity with cloud security, Familiarity with vulnerability management, Familiarity with incident response, Familiarity with threat intelligence, Experience with engineering, Experience with data processing and analysis tools, Familiarity with network observability, Familiarity with security software, Familiarity with data engineering solutions, Familiarity with Chronicle, Familiarity with Tines, Familiarity with osquery, Familiarity with Splunk", "remoteFriendly" : true, "rawDescription" : "Who we are About Stripe Stripe is a financial infrastructure platform for businesses. Millions of companies - from the world’s largest enterprises to the most ambitious startups - use Stripe to accept payments, grow their revenue, and accelerate new business opportunities. Our mission is to increase the GDP of the internet, and we have a staggering amount of work ahead. That means you have an unprecedented opportunity to put the global economy within everyone's reach while doing the most important work of your career. About the team The Security Incident Response team is responsible for triaging and assessing the severity of incoming security alerts, responding with initial containment measures and escalating as needed to incident responders for further investigation and resolution. They analyze a variety of data sources to identify potential threats, collect requirements for operational enhancements to detection and response systems, and generally scale security processes. From external attacks to insider threats, our goal is to respond with speed and precision, remediate, and support the incident postmortem process. The team is distributed globally and regularly coordinates with stakeholders in North America, Europe, and Asia. What you’ll do You will leverage your security management experience to improve incident response capabilities at Stripe. You will manage a team of security analysts, investigators, and responders on the front lines of the incident response process, hiring, training, and evaluating their performance, providing technical guidance where needed, developing clear and consistent response procedures, and ensuring timely and effective resolution of casework. You will also collaborate with various internal stakeholders, including the Security Analytics and Detection teams, and make continuous improvements to Stripe’s security incident response function. Responsibilities Lead and support a team of security analysts, investigators, and responders who triage, assess, and respond to threats Provide technical guidance to the team, as a subject matter expert Influence the organizational mission and vision by ensuring prioritization and delivery of project work that is aligned with relevant security roadmaps Strengthen KPIs and metrics for measuring response operations effectiveness, for clear and consistent reporting to internal stakeholders Work cross-functionally with security engineering teams to gather requirements for analyzing and responding to security events data at scale while protecting Stripe networks, systems, and data from threats Develop, document, and implement strategies, runbooks, and capabilities to support the incident response process Continuously improve security processes and response capabilities by collaborating with security engineers and analysts Coach and mentor individual contributors, enabling career development and championing quality standards within the team Who you are We're looking for someone who meets the minimum requirements to be considered for the role. If you meet these requirements, you are encouraged to apply. The preferred qualifications are a bonus, not a requirement. Minimum requirements 5+ years experience leading Security Operations or Incident Response teams, including hands-on, technical management experience of security analysts or engineers B. S. or M. S. Computer Science or related field, or equivalent experience in Security Experience recruiting, growing, and leading technical teams, including performance management Excellent written and verbal communication skills, including the ability to develop and deliver operational or incident-related information to leadership Advanced knowledge of data analytics (e. g. logs for first or third party applications, system / data access events), network security, digital forensics, and incident response investigations Experience with Python and SQL, and/or familiarity with other programming languages Familiarity with operating systems, file systems, and memory on macOS, Linux, or Windows Strong understanding of threat actor tactics, techniques, and procedures (TTPs) Preferred qualifications Broad knowledge and experience across the information security domain, including familiarity with endpoint, email, network, identity management, cloud security, vulnerability management, incident response, and threat intelligence. Experience with engineering, data processing and analysis tools Familiarity with network observability, security software, or data engineering solutions (Chronicle, Tines, osquery, Splunk, etc.)", "summaryDescription" : "Security Incident Response Manager at Stripe. Skills: Incident Response Management, Security Operations, Team Leadership, Threat Analysis. Leverage security management experience. Improve incident response capabilities", "postedDate" : "2026-06-16T01:16:18.624", "createdAt" : "2026-06-16T01:16:18.624", "lastUpdated" : "2026-06-16T11:17:32.753", "ingestTimestamp" : "2026-06-16T01:16:18.624", "mongoId" : "6a306fd5f292fd229cfed7df", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "100k-150k", "hasSalary" : false, "allSkills" : [ "Incident response", "Threat analysis", "Forensic investigation", "Data analysis", "Network security", "System administration", "Leadership", "Incident Response Management", "Security Operations", "Team Leadership", "Threat Analysis", "Security management", "Data analytics", "Digital forensics", "Threat intelligence", "Data processing", "Roadmap planning", "Threat actor tactics", "Threat actor techniques", "Threat actor procedures", "Security incident response", "Chronicle", "Tines", "Osquery", "Splunk" ], "skillCount" : 25, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Manager", "dataQualityScore" : 0.8888889, "_score" : 1254.4054, "daysOld" : 0, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "FinTech", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2c8c8374d8ee00a0975b5a", "title" : "Incident Response Lead", "company" : "WHOOP", "industry" : "Information Security", "salary" : { "min" : 130000.0, "max" : 170000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Boston, MA", "locations" : [ "Boston, MA" ], "certifications" : [ "GCIH", "GCFA", "CISSP" ], "timestamp" : "2026-06-15T12:05:20.732", "fingerprint" : "bddddbefd297cde0f29d2286596a2e145615d870cd25df0e237c4a59536e642a", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/whoop/90e465bb-f1fb-4763-892e-320780db4f6f/application", "externalId" : "90e465bb-f1fb-4763-892e-320780db4f6f", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Boston", "state" : "Massachusetts", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "42.3588336,-71.0578303" } ], "locationText" : "Boston, Massachusetts, United States", "employmentType" : "FULL_TIME", "experienceMinYears" : 7, "experienceMaxYears" : 15, "experienceLevel" : "Lead", "technicalSkills" : "SIEM, EDR, Cloud security monitoring, Digital forensics, Threat detection", "professionalSkills" : [ "Incident command", "Root cause analysis", "Breach impact assessment", "Regulatory notification" ], "hardSkillsList" : [ "Incident response", "Digital forensics", "Threat detection", "SOC operations", "Host investigation", "Cloud investigation", "Log investigation" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Digital forensics", "level" : "intermediate" }, { "name" : "Threat detection", "level" : "intermediate" }, { "name" : "SOC operations", "level" : "intermediate" }, { "name" : "Host investigation", "level" : "intermediate" }, { "name" : "Cloud investigation", "level" : "intermediate" }, { "name" : "Log investigation", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident response, Digital forensics, Threat detection, SOC operations", "majorSkillsList" : [ "Incident response", "Digital forensics", "Threat detection", "SOC operations" ], "coreResponsibilities" : "Lead incident response activities, Serve as incident commander, Partner with SOC, Validate alerts, Guide investigations, Drive containment, Drive eradication, Conduct host investigations, Conduct cloud investigations, Conduct log investigations, Coordinate with forensic firms, Maintain incident response playbooks, Improve escalation procedures, Improve communication workflows, Lead post-incident reviews, Lead root cause analysis, Define remediation actions, Track remediation actions, Develop tabletop exercises, Execute incident simulations, Support breach impact assessments, Support regulatory notification, Improve detection capabilities, Improve response capabilities, Own incident metrics, Own incident reporting, Report response times, Report trends, Report risk reduction", "teamCollaboration" : "24x7 SOC provider; Cross-functional stakeholders; Security, IT, GRC, Legal", "projectManagementSkills" : [ "Remediation tracking" ], "domainKnowledge" : "Cloud-native environments; MITRE ATT&CK; GDPR; HIPAA; PCI", "domainList" : [ "cloud-native-environments", "mitre-att-ck", "gdpr", "hipaa", "pci" ], "domainSpecificKnowledge" : [ "Cloud-native environments", "MITRE ATT&CK", "GDPR", "HIPAA", "PCI" ], "toolProficiency" : [ "SIEM platforms", "EDR tools", "Cloud monitoring" ], "communicationSkills" : "Cross-functional coordination", "problemSolvingSkills" : "Root cause analysis", "specialRequirements" : "On-call escalation rotation", "outcomesObjectives" : "Systemic risk reduction", "qualificationsBasic" : "7+ years incident response, Lead incident investigations, Host, cloud, log investigations, SIEM platforms expertise, EDR tools expertise, Cloud security monitoring expertise, Work with external SOC, Attack frameworks understanding, GDPR, HIPAA, PCI support, Excellent communication skills, Bachelor's degree or certifications", "qualificationsPreferred" : "GCIH certification, GCFA certification, CISSP certification", "workSiteFlexibility" : "Onsite", "rawDescription" : "At WHOOP, we’re on a mission to unlock human performance and healthspan. Our wearable technology provides personalized insights that help millions of members better understand their bodies and make smarter decisions about training, recovery, and lifestyle. We are seeking a Incident Response Lead to drive security incident response across the enterprise. In this role, you will serve as the primary internal escalation point and hands-on responder for security incidents, partnering closely with WHOOP’s 24x7 SOC provider and cross-functional stakeholders to investigate, contain, and remediate threats. This is a highly technical individual contributor role with significant ownership and visibility across Security, IT, GRC, and Legal. RESPONSIBILITIES: - - Lead hands-on incident response activities, serving as the primary internal escalation point for security events - Serve as the central incident commander across Security, IT, GRC, and Legal during active incidents - Partner with the SOC to validate alerts, guide investigations, and drive containment and eradication efforts - Conduct host, cloud, and log-based investigations, and coordinate with external forensic firms when needed - Maintain and continuously improve incident response playbooks, escalation procedures, and communication workflows - Lead post-incident reviews and root cause analysis, ensuring remediation actions are clearly defined and tracked - Develop and execute tabletop exercises and incident simulations to test and strengthen response readiness - Partner with GRC and Legal to support breach impact assessments and regulatory notification processes - Drive continuous improvement of detection and response capabilities across SIEM, EDR, cloud monitoring, and identity systems - Own incident metrics and reporting, including response times, trends, and systemic risk reduction initiatives - Participate in an on-call escalation rotation to provide after-hours incident leadership when required QUALIFICATIONS: - - 7+ years of experience in incident response, digital forensics, threat detection, or SOC operations - Proven experience leading incident investigations in complex, cloud-native environments - Strong experience conducting host, cloud, and log-based investigations - Hands-on expertise with SIEM platforms, EDR tools, and cloud security monitoring - Experience working with external SOC or MDR providers - Strong understanding of attack frameworks (MITRE ATT&CK) and their application to detection and response - Experience supporting breach response obligations under GDPR, HIPAA, PCI, or similar regulatory frameworks - Excellent communication skills with the ability to coordinate cross-functional stakeholders under pressure - Bachelor’s degree or relevant certifications (GCIH, GCFA, CISSP, or equivalent) This role is based in the WHOOP office located in Boston, MA. The successful candidate must be prepared to relocate if necessary to work out of the Boston, MA office. Interested in the role, but don’t meet every qualification? We encourage you to still apply! At WHOOP, we believe there is much more to a candidate than what is written on paper, and we value character as much as experience. As we continue to build a diverse and inclusive environment, we encourage anyone who is interested in this role to apply. WHOOP is an Equal Opportunity Employer and participates in E-verify https://www.e-verify.gov/to determine employment eligibility The WHOOP compensation philosophy is designed to attract, motivate, and retain exceptional talent by offering competitive base salaries, meaningful equity, and consistent pay practices that reflect our mission and core values. At WHOOP, we view total compensation as the combination of base salary, equity, and benefits, with equity serving as a key differentiator that aligns our employees with the long-term success of the company and allows every member of our corporate team to own part of WHOOP and share in the company’s long-term growth and success. The U.S. base salary range for this full-time position is $130,000 - $170,000. Salary ranges are determined by role, level, and location. Within each range, individual pay is based on factors such as job-related skills, experience, performance, and relevant education or training. In addition to the base salary, the successful candidate will also receive benefits and a generous equity package. These ranges may be modified in the future to reflect evolving market conditions and organizational needs. While most offers will typically fall toward the starting point of the range, total compensation will depend on the candidate’s specific qualifications, expertise, and alignment with the role’s requirements. ", "summaryDescription" : "Incident Response Lead at WHOOP. Skills: Incident response, Digital forensics, Threat detection, SOC operations. Lead incident response activities. Serve as incident commander", "createdAt" : "2026-06-14T04:00:46.619", "lastUpdated" : "2026-06-15T12:05:20.732", "ingestTimestamp" : "2026-06-14T04:00:46.619", "mongoId" : "6a2c8c8374d8ee00a0975b5a", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 130000, "salaryAnnualMax" : 170000, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Incident response", "Digital forensics", "Threat detection", "SOC operations", "Host investigation", "Cloud investigation", "Log investigation", "Leadership", "Incident command", "Root cause analysis", "Breach impact assessment", "Regulatory notification", "Remediation tracking", "Cloud-native environments", "MITRE ATT&CK", "GDPR", "HIPAA", "PCI", "GCIH", "GCFA", "CISSP", "SIEM platforms", "EDR tools", "Cloud monitoring" ], "skillCount" : 24, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Lead", "dataQualityScore" : 0.8888889, "_score" : 1106.7312, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.98 }, { "id" : "6a2c6a8f74d8ee00a090c9b3", "title" : "Project Manager, Incident Response", "company" : "ABACUS", "industry" : "Cybersecurity", "salary" : { "min" : 145000.0, "max" : 205000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior Project Manager, Incident Response in the US Technology industry, adjusted for a remote work mode and manager experience level." }, "location" : "Remote in US", "locations" : [ "Remote in US" ], "certifications" : [ "PMP certification" ], "timestamp" : "2026-06-15T10:35:48.757", "fingerprint" : "1c88e11e9a6dddc3effeac573435e516572e6903d0011c5dae97ea2497aee0f5", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://abacustechnology.com/about/careers/current-vacancies/?gh_jid=7731438003", "externalId" : "7731438003", "industryFunction" : { }, "structuredLocations" : [ { "country" : "United States", "continent" : "na", "workMode" : "remote" } ], "locationText" : "United States", "employmentType" : "FULL_TIME", "experienceLevel" : "Manager", "technicalSkills" : "Systems engineering, Infrastructure deployment, Infrastructure enhancement", "professionalSkills" : [ "Process management", "Cross-functional coordination", "Vendor management", "Stakeholder management", "Resource planning", "Continuous improvement", "Client-facing communication", "Expectation management", "Timeline management", "Consultative rapport" ], "hardSkillsList" : [ "Event log analysis", "Syslog analysis", "Monitoring data analysis", "Memory dump analysis", "Troubleshoot issues", "Configure systems", "Test systems", "Implement systems", "Refine systems", "Document systems", "Monitor systems", "Transition systems" ], "softSkillsList" : [ "Leadership", "Persistence", "Calm under pressure" ], "hardSkills" : [ { "name" : "Event log analysis", "level" : "intermediate" }, { "name" : "Syslog analysis", "level" : "intermediate" }, { "name" : "Monitoring data analysis", "level" : "intermediate" }, { "name" : "Memory dump analysis", "level" : "intermediate" }, { "name" : "Troubleshoot issues", "level" : "intermediate" }, { "name" : "Configure systems", "level" : "intermediate" }, { "name" : "Test systems", "level" : "intermediate" }, { "name" : "Implement systems", "level" : "intermediate" }, { "name" : "Refine systems", "level" : "intermediate" }, { "name" : "Document systems", "level" : "intermediate" }, { "name" : "Monitor systems", "level" : "intermediate" }, { "name" : "Transition systems", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" }, { "name" : "Persistence" }, { "name" : "Calm under pressure" } ], "majorSkills" : "Incident response, Project delivery, Client management", "majorSkillsList" : [ "Incident response", "Project delivery", "Client management" ], "coreResponsibilities" : "Coordinate external technical projects, Follow established core processes, Follow project templates, Follow methodologies, Lead Professional Services stand-ups, Review event logs, Review Syslogs, Review monitoring data, Review memory dumps, Troubleshoot issues, Provide security-enhancing solutions, Maintain billable utilization targets, Generate mandatory reports, Update mandatory reports daily, Meet project deadlines, Exceed project deadlines, Keep projects profitable, Measure project success, Leverage cost variance, Leverage schedule variance, Contribute to customer satisfaction, Record change details, Record time worked, Record work notes in ServiceNow, Identify process improvement opportunities, Execute project deliverables, Transition deliverables to stakeholders, Perform approved changes, Communicate project status internally, Communicate project status externally, Provide project follow-ups, Provide requested feedback", "teamCollaboration" : "Cross-functional teams; Client calls; Internal communication; External communication", "projectManagementSkills" : [ "Project management", "Waterfall projects", "Process management", "Methodologies" ], "domainKnowledge" : "Incident response; Technical environments; Containment strategies; Recovery strategies; MFA; Endpoint protection; Systems; Applications; Infrastructures", "domainList" : [ "incident-response", "technical-environments", "containment-strategies", "recovery-strategies", "mfa", "endpoint-protection", "systems", "applications", "infrastructures" ], "domainSpecificKnowledge" : [ "Incident response", "Technical environments", "Containment strategies", "Recovery strategies", "MFA", "Endpoint protection", "Systems", "Applications", "Infrastructures" ], "toolProficiency" : [ "ServiceNow" ], "communicationSkills" : "Client-facing communication; Verbal communication; Writing skills; Professional wording; Grammatically pristine; Clear communication; Effective communication; Persuasive communication; Translate technical to C-Suite; Convey energy; Convey confidence; Convey interest; Convey competence; Convey professionalism; Convey trustworthiness", "documentationSkills" : "Thorough documentation; Status updates", "continuousLearning" : "Online courses", "problemSolvingSkills" : "Troubleshoot issues; Sort through chaos; Make order; Uncover hidden gems; Scale roadblocks; Dodge roadblocks; Blast through roadblocks", "specialRequirements" : "On-call rotation, Work into evenings, Work into weekends, Work into holidays, Minimal travel, Open to travel", "outcomesObjectives" : "Result in progressive change; Result in secure enhancements; Establish ownership of direction; Ensure parties are aligned; Deliver strategic initiatives; Achieve high customer satisfaction scores; Keep projects profitable; Not skimp on quality", "qualificationsBasic" : "5 years of experience delivering IT waterfall projects, Managed projects as assigned PM, Owned client-facing projects, Experience with systems and virtualization, Exposure to enterprise infrastructures, Adaptable approach to working hours, Open to travel when needed", "qualificationsPreferred" : "Four-year degree in relevant field, PMP certification", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "Job Summary: As our Incident Response Project Manager, you will be primarily dedicated to external, client-facing projects within our Incident Response team. You will be the driving force behind successful, thorough, and robust project deliverables that result in progressive change and secure enhancements to our client’s technical environments.As the primary face of the team on client calls, you will field questions, establish trust, and set precedent as the go-to person for all incident-related matters. You will be tasked with understanding the current state of an incident, establishing ownership of the overall direction of containment and recovery, and ensuring all parties are aligned with the verticals defined. Constantly in sync with the primary lead engineer leading containment and recovery strategies and delivering agreed-upon strategic initiatives to all parties, you will work as part of a dynamic, flexing team – ready to respond at a moment’s notice mapping into your team's on-call rotation. This position will report directly to our Director of Incident Response PMO. Responsibilities (including, but not limited to): Project Management Coordinates multiple, external technical projects from inception to completion: Follows established core processes, project templates, and methodologies Takes a lead in Professional Services stand-ups review event logs, Syslogs, monitoring data, and memory dumps to troubleshoot issues. Security-enhancing solutions for systems and applications (including MFA and endpoint protection). Metrics Measuring Success Maintains billable utilization targets Ensures all mandatory reports are generated and updated daily Meets or exceeds deadlines for all assigned projects Keeps projects profitable while not skimping on quality Leverages cost variance and schedule variance formulas to measure project success Contributes to the team’s attainment of high customer satisfaction scores on project delivery Records complete change details, time worked entries, and work notes in ServiceNow in real-time Identifies opportunities for process improvement Following Process Follows Entara’s project process to execute project deliverables: configure, test, implement, refine, document, monitor, and transition to appropriate stakeholders. Follows Entara’s Change Management Process to perform approved changes in client environments Communicates internally and (as directed) externally to provide timely information regarding project status, promised follow-ups, and requested feedback on a detailed and professional basis. Skills and Experience: You’re a knowledge seeker. Regardless of method, you have obtained and exposed yourself to knowledge centers that have qualified you to master technical project delivery and the systems engineering required to successfully recover, deploy, and enhance infrastructures. You ideally have a four-year degree in a relevant field and are working towards or have already obtained your PMP certification. You’ve managed projects as the assigned “PM” instead of only having delivered them as an engineer. You enjoy the dynamic of wearing multiple hats and taking the lead on client-facing communication, expectations, and timelines. You’ve owned client-facing projects and have established a consultative rapport resulting in high client satisfaction levels upon project closure. You have at least 5 years of experience delivering IT waterfall projects working with systems and virtualization with exposure to enterprise infrastructures. You keep us true to our word. You have a tried-and-true organizational system to keep yourself (and others) on task while ensuring exceptional quality. You possess a winning combination of superb writing skills and highly refined verbal communication skills. You convey energy, confidence, and genuine interest over a call just as easily as you convey competence, professionalism, and trustworthiness in person. You translate to a C-Suite audience as seamlessly as you “talk tech” with engineers. Your emails are professionally worded, grammatically pristine, with the right pinch of personality. In any medium, you pride yourself in clear, effective, and persuasive communication. You have an approach to working hours that is more adaptable than the traditional \"9-to-5\". As this team responds to business-critical remediation projects, we are looking for an individual who is career-driven and won’t shrink back when work requirements extend into evenings, weekends, and holidays. While travel is minimal, you’re also open to getting on a plane when needed to be present at client sites when a project requires it. On the flip side, your hard work is rewarded with a generous comp plan that grows with the efforts you contribute, a flexible PTO policy, and an equally inspiring team that climbs mountains together. You are ready to be an effective remote worker and have a dedicated, private space for a home office with a private internet connection with at least 50MBPS bandwidth. Public WiFi and shared common spaces do not meet these standards. Desired Personality Traits: A Mythical Character. You aren’t alarmed when someone expects you to be a hero; in fact, you pride yourself on frequently delivering big just when all hope seems lost. Your persistence is notable, and you are a determined soul who insists on turning “We can’t” into “We can” If you meet a roadblock, you’ll try to scale it, dodge it, or blast through it before ever admitting defeat. The Devil is in the Details. You have an angelic ability to sort through chaos and make order. Your eye and attention for details helps you uncover hidden gems, while your thorough documentation and status updates capture and convey every facet of each stone. Corporate Usain Bolt. You’re capable of moving rapidly from task to task without getting rattled. Your desk is clear, your email inbox is empty, your kitchen counters aren’t cluttered, and you never spend 15 minutes tearing around the house in a desperate hunt for your car keys or train pass. You are a lean, mean, well-oiled machine. A Combo Meal. Your style is winningly ambidextrous. While you are known to be a loyal teammate and never falter on your commitment to seeing others thrive, you are not a push-over. You will fight back and advocate for the best marriage of client desires and superb delivery-pushing us along the path towards perfection. If Samwise Gamgee and Monica Geller had a child, it would be you. Emotionally Mature. Through your years of experience, you’ve learned that occasional hiccups are inevitable and now know enough to just keep moving towards the end goal. You’re calm under pressure, encourage respectful dialog, and understand that communication is the balm that can soothe the sting of conflict. The Benefits of Working for Entara, an Abacus Group Company: Exposure to a diverse array of technologies. Internal opportunities for career advancement. Part of a team of experienced professionals that aim to deliver exceptional service Competitive compensation. Robust benefits package: medical, dental, vision, disability, life insurance, 401k, and PTO. Opportunities to further technical education through online courses. Positive, friendly, and supportive office environment.", "summaryDescription" : "Project Manager, Incident Response at ABACUS. Skills: Incident response, Project delivery, Client management. Coordinate external technical projects. Follow established core processes", "postedDate" : "2026-06-14T01:43:32.664", "createdAt" : "2026-06-14T01:43:32.664", "lastUpdated" : "2026-06-15T10:35:48.757", "ingestTimestamp" : "2026-06-14T01:43:32.664", "mongoId" : "6a2c6a8f74d8ee00a090c9b3", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 145000, "salaryAnnualMax" : 205000, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Event log analysis", "Syslog analysis", "Monitoring data analysis", "Memory dump analysis", "Troubleshoot issues", "Configure systems", "Test systems", "Implement systems", "Refine systems", "Document systems", "Monitor systems", "Transition systems", "Leadership", "Persistence", "Calm under pressure", "Incident response", "Project delivery", "Client management", "Process management", "Cross-functional coordination", "Vendor management", "Stakeholder management", "Resource planning", "Continuous improvement", "Client-facing communication", "Expectation management", "Timeline management", "Consultative rapport", "Project management", "Waterfall projects", "Methodologies", "Technical environments", "Containment strategies", "Recovery strategies", "MFA", "Endpoint protection", "Systems", "Applications", "Infrastructures", "PMP certification", "ServiceNow" ], "skillCount" : 41, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Senior", "dataQualityScore" : 1.0, "_score" : 1084.6206, "daysOld" : 1, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a25145374d8ee00a00bb369", "title" : "Incident Management Engineer (Spanish/English bilingual), Incident Detection and Response", "company" : "Amazon Web Services Australia Pty Ltd", "industry" : "Operations, IT, Support Engineering, Cloud Computing", "salary" : { "min" : 175000.0, "max" : 245000.0, "currency" : "AUD", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior Incident Management Engineer in Sydney, Australia, adjusted for the technology industry and a large company size." }, "location" : "Sydney, New South Wales, AUS", "locations" : [ "Sydney, New South Wales, AUS" ], "certifications" : [ "AWS Associate level certifications" ], "timestamp" : "2026-06-15T00:55:38.724", "fingerprint" : "215f83d4baf92237a7526340281af7ea6f4f60e3b3b81fb5e8d07800f2bec392", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10441540/apply", "externalId" : "6848a1ed-03fd-448c-825f-45e26cd76529", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Sydney", "state" : "New South Wales", "country" : "Australia", "continent" : "oc", "source" : "llm", "workMode" : "onsite", "geo" : "-33.8698439,151.2082848" } ], "locationText" : "Sydney, New South Wales, Australia", "employmentType" : "FULL_TIME", "technicalSkills" : "AWS", "professionalSkills" : [ "Incident Management", "Customer ownership", "Account ownership", "Problem solving", "Strategic planning" ], "hardSkillsList" : [ "Incident response", "Technical troubleshooting", "Runbook development", "Response plan development" ], "softSkillsList" : [ "Leadership", "Mentoring", "Critical thinking" ], "hardSkills" : [ { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Technical troubleshooting", "level" : "intermediate" }, { "name" : "Runbook development", "level" : "intermediate" }, { "name" : "Response plan development", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" }, { "name" : "Mentoring" }, { "name" : "Critical thinking" } ], "majorSkills" : "Incident Management, Incident Response, Customer Support", "majorSkillsList" : [ "Incident Management", "Incident Response", "Customer Support" ], "coreResponsibilities" : "Drive resolution of large scale customer impacting incidents, Drive critical, complex customer escalations, Provide critical incident response/management, Lead calls with internal/external participants, Contribute to Problem Records, Conduct continuous real-time proactive monitoring, Prioritize, manage, and own customer issues, Monitor and manage communications during high impact events, Collaborate with key stakeholders across AWS, Improve customer experience, Develop mechanisms that support operational excellence, Lead projects and teams, Drive operational improvements, Create and review design, Influence new standard operating procedures, Identify and troubleshoot recurring platform issues, Own projects to drive improvements, Mentor peers, Perform other duties as required", "teamCollaboration" : "Cross-functional teams; Engineering Teams; Internal/external participants", "projectManagementSkills" : [ "Project management" ], "domainKnowledge" : "Cloud technologies; Distributed architectures; Mission critical applications", "domainList" : [ "cloud-technologies", "distributed-architectures", "mission-critical-applications" ], "domainSpecificKnowledge" : [ "Cloud technologies", "Distributed architectures", "Mission critical applications" ], "communicationSkills" : "Written communication; Verbal communication; Presenting to audience; Convey key details", "documentationSkills" : "Technical documentation", "problemSolvingSkills" : "Analytical acumen; Logical problem solving; Critical thinking; Troubleshoot recurring platform issues", "specialRequirements" : "Work weekends, Work public holidays", "qualificationsBasic" : "Business level Spanish and English, 3+ years Major Incident / Problem Manager Experience, 5+ years Support Engineering, Network Engineering, Solutions Architecture, or similar IT role, Bachelor’s degree in Computer Science, Information Science/Technology, Communications Engineering, Business, or related field (or 6+ years relevant work experience), Professional oral and written communication skills", "qualificationsPreferred" : "Industry specific accredited certification(s), AWS Associate level certifications, Knowledge of ITIL/Lean Processes, Ability to work in ambiguous environments, Demonstrated critical thinking and logical problem solving skills, Experience driving collaborative projects, Familiarity operating or designing distributed architectures, Ability to review complex technical details", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Amazon has built a reputation for excellence with a mission to be the earth’s most customer-centric company, a company that customers from all over the globe will recognize, value, and trust for both our products and our service. Amazon Web Services (AWS) is carrying on that tradition while leading the world in cloud technologies. The AWS Incident Detection and Response team is part of the ASPIRE organisation within AWS Support, and is dedicated to offering eligible AWS Enterprise Support customers proactive engagement and incident management to reduce the potential for failure and to accelerate recovery of critical workloads from disruption. We achieve these objectives by working closely with customers to develop runbooks and response plans customized to the context of each workload onboarded to the service. Onboarded workloads are monitored 24x7 by a team of Incident Management Engineers (IMEs) to detect and engage customers on a call bridge within 5 minutes of a critical alarm. ABOUT YOU Incident Management Engineers have a broad skill set with demonstrated career progression and a proven track record of delivering results. The successful candidate will possess strong analytical acumen, solid technology experience, superb business judgment, strategic account ownership and a propensity to dive deep to solve complex problems. You will also have a passion for creating/providing a world class experience for our customers. The candidate must understand the competitive and industry landscape and must have the leadership presence and communication skills to effectively work with customers at all levels of their organization. You must be a self-starter and able to execute at both a tactical and strategic level – with a strong attention to detail. This is a global role that requires excellent written and verbal communication skills and a passion and desire for leading the resolution of critical incidents. Your decisions are not only fundamental to helping protect our most critical customers but will help maintain the health of AWS customers worldwide. Finally, you are passionate about technology with a desire to learn more and do more with AWS. ABOUT THE ROLE AWS Support is looking for a leader with a strong background in Incident Management and customer ownership to be there during the moments that matter for our most critical customers. We are looking for an Incident Management Engineer to join our team to provide incident response and account ownership. In this position, you will play a pivotal role in providing communication, emergency response, technical resolver engagement and incident management for our customers. Please note as a follow-the-sun organisation, IMEs work the core hours of 9am-5pm AEST. Successful applicants will be required to work some weekends (Sunday to Thursday, or Tuesday to Saturday), and public holidays. Key job responsibilities - Every day will bring new and exciting challenges that include elements of: - Drive the resolution of large scale customer impacting incidents as part of a team rotation - Drive critical, complex customer escalations in situations that are sometimes technically challenging in collaboration with Engineering Teams. - Provide critical incident response/management (including leading calls with internal/external participants) for customer’s critical workloads - Contribute to Problem Records for customers - Conduct continuous real-time proactive monitoring of customer metrics - Prioritize, manage, and own emerging and developing customer issues from start to finish - Monitor and manage communications during high impact events via relevant channels - Collaborate with key stakeholders across AWS to improve the customer experience and develop mechanisms that support operational excellence - Lead projects and teams to drive operational improvements - Create and review documentation; design/influence new standard operating procedures - Identify and troubleshoot recurring platform issues and own projects to drive improvements - Mentor peers in your areas of technical and operational strength - Perform other duties as required by the organization About the team Diverse Experiences AWS values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why AWS? Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopted cloud platform. We pioneered cloud computing and never stopped innovating — that’s why customers from the most successful startups to Global 500 companies trust our robust suite of products and services to power their businesses. Inclusive Team Culture Here at AWS, it’s in our nature to learn and be curious. Our employee-led affinity groups foster a culture of inclusion that empower us to be proud of our differences. Ongoing events and learning experiences, including our Conversations on Race and Ethnicity (CORE) and AmazeCon (gender diversity) conferences, inspire us to never stop embracing our uniqueness. Mentorship & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, mentorship and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve in the cloud. Basic Qualifications: - Business level Spanish and English, verbal and written - 3+ years demonstrable Major Incident / Problem Manager Experience for organizations that run mission critical applications - 5+ years of experience in Support Engineering, Network Engineering, Solutions Architecture, or similar IT role. - Bachelor’s degree in Computer Science, Information Science/Technology, Communications Engineering, Business, or a related field (or 6+ years of relevant work experience) - Professional oral and written communication skills, presenting to an audience containing one or more executive team member(s) Preferred Qualifications: - Industry specific accredited certification(s) such as the AWS Associate level certifications - Knowledge of ITIL/Lean Processes - Ability to work in ambiguous environments - Demonstrated critical thinking and logical problem solving skills - Experience driving collaborative projects from conception to delivery - Familiarity operating or designing distributed architectures with the ability to correlate system behaviors based on known inter-dependencies - Ability to review complex technical details regarding ongoing issues/events and convey the key details to senior stakeholders to facilitate real-time decision making Acknowledgement of country: In the spirit of reconciliation Amazon acknowledges the Traditional Custodians of country throughout Australia and their connections to land, sea and community. We pay our respect to their elders past and present and extend that respect to all Aboriginal and Torres Strait Islander peoples today. IDE statement: Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Incident Management Engineer (Spanish/English bilingual), Incident Detection and Response at Amazon Web Services Australia Pty Ltd. Skills: Incident Management, Incident Response, Customer Support. Drive resolution of large scale customer impacting incidents. Drive critical, complex customer escalations", "postedDate" : "2026-06-13T10:47:22.538", "createdAt" : "2026-06-13T10:47:22.538", "lastUpdated" : "2026-06-15T00:55:38.724", "ingestTimestamp" : "2026-06-13T10:47:22.538", "mongoId" : "6a25145374d8ee00a00bb369", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10441540/apply", "salaryBand" : "150k-200k", "hasSalary" : false, "allSkills" : [ "Incident response", "Technical troubleshooting", "Runbook development", "Response plan development", "Leadership", "Mentoring", "Critical thinking", "Incident Management", "Incident Response", "Customer Support", "Customer ownership", "Account ownership", "Problem solving", "Strategic planning", "Project management", "Cloud technologies", "Distributed architectures", "Mission critical applications", "AWS Associate level certifications" ], "skillCount" : 19, "jobCategory" : "operations", "dataQualityScore" : 0.8888889, "_score" : 1076.9758, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Cloud Technologies" }, { "id" : "6a2c8bbe74d8ee00a097397f", "title" : "Project Manager (Incident Response)", "company" : "MOXFIVE", "industry" : "PMO", "salary" : { "min" : 80000.0, "max" : 120000.0, "currency" : "USD", "frequency" : "Yearly" }, "location" : "Remote", "locations" : [ "Remote" ], "certifications" : [ "CAPM", "PMP", "CSM" ], "timestamp" : "2026-06-15T05:22:05.118", "fingerprint" : "3d1634295f9f4c519ba215312b85f54aa5fdb74d333a0d872e01a70dca4acf3e", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/moxfive/67da822e-6f01-4495-be15-23a58c291040/application", "externalId" : "67da822e-6f01-4495-be15-23a58c291040", "industryFunction" : { }, "structuredLocations" : [ { "workMode" : "remote" } ], "locationText" : "", "employmentType" : "FULL_TIME", "minimumEducation" : "Bachelor's", "experienceLevel" : "Manager", "professionalSkills" : [ "Process management", "Cross-functional coordination", "Vendor management", "Stakeholder management", "Operational metrics", "Resource planning", "Continuous improvement" ], "hardSkillsList" : [ "Financial tracking", "Budget monitoring", "Time tracking", "Project accounting" ], "hardSkills" : [ { "name" : "Financial tracking", "level" : "intermediate" }, { "name" : "Budget monitoring", "level" : "intermediate" }, { "name" : "Time tracking", "level" : "intermediate" }, { "name" : "Project accounting", "level" : "intermediate" } ], "majorSkills" : "Incident response, Project management, Client communication", "majorSkillsList" : [ "Incident response", "Project management", "Client communication" ], "coreResponsibilities" : "Coordinate incident response projects, Align technical workstreams, Serve as connection to clients, Serve as connection to technical teams, Serve as connection to legal counsel, Serve as connection to stakeholders, Own project documentation, Generate Statements of Work, Generate change orders, Generate level of efforts, Compile status updates, Distribute status updates, Monitor project budgets, Track time, Track expenses, Flag scope creep, Coordinate scheduling for meetings, Coordinate scheduling for technical activities, Coordinate scheduling for stakeholder briefings, Identify project risks, Surface project risks, Contribute to process improvement, Contribute to system improvement", "teamCollaboration" : "Cross-functional workstreams; Client coordination; Technical team coordination; Legal counsel coordination; Stakeholder coordination", "projectManagementSkills" : [ "Project coordination", "Project management", "Milestone logging", "Deliverable scheduling", "Call cadence management", "Scope creep management", "Risk identification" ], "domainKnowledge" : "Incident response; Cybersecurity; IT services; Ransomware attacks; Forensics; Restoration; Remediation; Legal documentation; Client communications", "domainList" : [ "incident-response", "cybersecurity", "it-services", "ransomware-attacks", "forensics", "restoration", "remediation", "legal-documentation", "client-communications" ], "domainSpecificKnowledge" : [ "Incident response", "Cybersecurity", "IT services", "Ransomware attacks", "Forensics", "Restoration", "Remediation", "Legal documentation", "Client communications" ], "toolProficiency" : [ "Microsoft Office", "Excel", "PowerPoint", "Salesforce", "HubSpot" ], "communicationSkills" : "Status reports; Client-facing documentation; Stakeholder briefings", "documentationSkills" : "Project documentation; Trackers; Status reports; Milestone logs; Deliverable schedules; Call cadence", "continuousLearning" : "Process improvement; System improvement", "problemSolvingSkills" : "Complexity management", "specialRequirements" : "On-call schedule rotation", "outcomesObjectives" : "Keep projects organized; Shape client experience; Keep response on track; Maintain client trust; Engagements close with precision; Engagements close with professionalism", "qualificationsBasic" : "3+ years project coordination experience, 3+ years project management experience, Bachelor's degree or equivalent experience", "qualificationsPreferred" : "Background in consulting, Background in professional services, Background in client-facing coordination, Exposure to cybersecurity, Exposure to IT services, Exposure to incident response, Experience generating SOWs, Experience generating proposals, Experience generating contract documentation, Familiarity with legal requirements, Familiarity with insurance requirements, Experience with CRM systems, CAPM certification, PMP certification, CSM certification, Actively working toward certification", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "Project Manager (Incident Response) Who You Are You are the person who makes chaos look manageable. When a cyberattack hits and five workstreams are spinning at once, you're the one holding the center, tracking every moving part, keeping every stakeholder informed, and making sure nothing falls through the cracks. You don't need to speak fluent threat actor, but you know exactly what needs to happen next and who needs to know about it. You speak with clients just as fluently as you speak with the technical team. You know the difference between a status update that actually helps and one that just creates more questions. You've managed projects under pressure before, and you've learned that in high-stakes environments, precision and calm are superpowers. You're wired for complexity. Juggling 5–8 concurrent engagements doesn't overwhelm you, it's where you do your best work. You care about the details that others overlook, because you know those details are what keep a response on track and a client's trust intact. Why You Matter You'll be joining MOXFIVE as a Project Manager supporting our Incident Response practice - the operational backbone that keeps our engagements running when organizations need us most. When ransomware strikes, the technical work is only part of the story. Forensics, restoration, remediation, legal documentation, client communications all must move simultaneously, and someone has to orchestrate it all. That's you. You're the reason our technical teams can stay focused on the response itself, our clients stay informed without feeling lost, and our engagements close with the precision and professionalism MOXFIVE is known for. Your work doesn't just keep projects organized. It directly shapes how organizations experience one of the most stressful moments they'll ever face. What You'll Do - Coordinate incident response projects across concurrent technical workstreams keeping everything and everyone aligned - Serve as the connection between clients, technical teams, legal counsel, and internal MOXFIVE stakeholders - Own project documentation: trackers, status reports, milestone logs, deliverable schedules, call cadence. They must be accurate, complete, and always current - Generate Statements of Work, change orders, and level of efforts with clear scope and pricing - Compile and distribute timely status updates that tell the story of where an engagement stands - Monitor project budgets, track time and expenses, and flag potential scope creep before they become a problem - Coordinate scheduling for client meetings, technical activities, and stakeholder briefings across a portfolio of active engagements - Identify and surface project risks early, working with stakeholders to keep things on course - Participate in a rotating on-call schedule (roughly once every six weeks) to support active incident response operations - Contribute to the ongoing improvement of MOXFIVE's project management processes and systems What You'll Bring - 3+ years of project coordination or project management experience, ideally in consulting, professional services, or technology environments - Exceptional organizational skills and meticulous attention to detail, you manage multiple concurrent projects without losing track of what matters - Strong written and verbal communication skills, with the ability to create clear, confident status reports and client-facing documentation - Proficiency with project management platforms - Advanced skills in Microsoft Office, particularly Excel and PowerPoint - Comfort interfacing with clients, partners, and senior stakeholders in fast-moving, high-pressure situations - Financial tracking experience - budget monitoring, time tracking, and basic project accounting - A process-oriented mindset with an eye for where things can be done better - Bachelor's degree in business, communications, or a related field. Or the equivalent in real-world experience Bonus points for: - Background in consulting, professional services, or client-facing coordination roles - Exposure to cybersecurity, IT services, or incident response environments - Experience generating SOWs, proposals, or contract documentation - Familiarity with legal or insurance-related project requirements - Experience with CRM systems like Salesforce or HubSpot - CAPM, PMP, CSM, or other project management certification (or actively working toward one)", "summaryDescription" : "Project Manager (Incident Response) at MOXFIVE. Skills: Incident response, Project management, Client communication. Coordinate incident response projects. Align technical workstreams", "createdAt" : "2026-06-13T22:06:35.396", "lastUpdated" : "2026-06-15T05:22:05.118", "ingestTimestamp" : "2026-06-13T22:06:35.396", "mongoId" : "6a2c8bbe74d8ee00a097397f", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 80000, "salaryAnnualMax" : 120000, "salaryBand" : "75k-100k", "hasSalary" : true, "allSkills" : [ "Financial tracking", "Budget monitoring", "Time tracking", "Project accounting", "Incident response", "Project management", "Client communication", "Process management", "Cross-functional coordination", "Vendor management", "Stakeholder management", "Operational metrics", "Resource planning", "Continuous improvement", "Project coordination", "Milestone logging", "Deliverable scheduling", "Call cadence management", "Scope creep management", "Risk identification", "Cybersecurity", "IT services", "Ransomware attacks", "Forensics", "Restoration", "Remediation", "Legal documentation", "Client communications", "CAPM", "PMP", "CSM", "Microsoft Office", "Excel", "PowerPoint", "Salesforce", "HubSpot" ], "skillCount" : 36, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Mid", "dataQualityScore" : 0.8888889, "_score" : 1063.9978, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "Cybersecurity", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2db03474d8ee00a0c83a95", "title" : "Tier 3, Engineer 4 – Network Solutions Engineer", "company" : "Comcast Business", "industry" : "Technology", "salary" : { "min" : 98426.32, "max" : 162403.44, "currency" : "USD", "frequency" : "yearly" }, "location" : "United States of America", "locations" : [ "United States of America" ], "timestamp" : "2026-06-16T02:47:48.404", "fingerprint" : "3fd5a51ebbeedd719bb88f3beab755dfed9edfe85b29a4426009b5b1fb538a85", "source" : "workday", "language" : "en", "applyUrl" : "https://comcast.wd5.myworkdayjobs.com/Comcast_Careers/job/TX---Plano-7900-Windrose-Avenue-8th-Floor/Tier-3--Engineer-4---Network-Solutions-Engineer_R438620", "externalId" : "R438620", "industryFunction" : { }, "locationPoint" : "51.43667,5.97917", "structuredLocations" : [ { "country" : "United States", "continent" : "na", "workMode" : "onsite" } ], "locationText" : "United States", "employmentType" : "FULL_TIME", "minimumEducation" : "Bachelor's Degree", "experienceMinYears" : 7, "experienceMaxYears" : 10, "experienceLevel" : "Senior", "qualificationsBasic" : "7+ years experience, Bachelor's Degree", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "Comcast Business offers a suite of Connectivity, Communications, Networking, Cybersecurity, Wireless, and Managed Solutions to help global organizations of all sizes prepare for what’s next. Powered by the nation’s largest Gig-speed broadband network and backed by 24/7 customer support, Comcast Business is the nation’s largest technology provider to small businesses and one of the leading service providers to the Enterprise market. Comcast Business has been consistently recognized by industry analysts and associations as a leader and innovator, and one of the fastest growing providers of Ethernet services. **Job Summary** The Tier 3, Engineer 4 role provides senior‑level technical execution and leadership for complex enterprise network activations supporting large, high‑visibility customers. This role independently drives day‑to‑day technical decisions, partners directly with customers and internal stakeholders, and coordinates cross‑functional teams to deliver successful network implementations. Tier 3, Engineer 4 acts as a technical escalation point for the team, balances customer and business requirements, and ensures issues are resolved efficiently with a strong focus on service quality and operational excellence. They contribute to continuous improvement efforts through root cause analysis and tactical process enhancements. **Job Description** **Core Responsibilities:** * Advanced Technical Expertise: Deep hands‑on knowledge of enterprise network architectures and SDN/SDWAN solutions; capable of designing, activating, and troubleshooting complex network implementations. * Customer & Partner Communication: Communicates effectively with enterprise customers and internal teams, translating technical details into clear impacts, risks, and recommendations. * Cross‑Functional Coordination: Works across engineering, service delivery, product, and operations teams to deliver end‑to‑end activation outcomes. * Ownership & Accountability: Takes ownership of assigned activations and issues from initiation through resolution, proactively identifying and mitigating risks. * Independent Decision‑Making: Exercises sound technical judgment and autonomy within established frameworks, considering both customer experience and business priorities. * Problem Resolution & RCA: Performs root cause analysis on complex issues and recommends targeted improvements to processes, designs, or tooling. * Works in a 24x7 Operations environment supporting live customers. * Regular, consistent and punctual attendance. Must be able to work nights and weekends, variable schedule(s) as necessary. * Performs technical training to junior operations/engineering team members. * Provisions network service configuration in the Software Defined Network (SDN) Service platform for services such as Firewall, NAT/PAT, QoS, DHCP, Traffic Steering, BGP, Static Routes, Wireless Backup, Hybrid WAN, High Availability, LAN and WAN interfaces, etc. * Completes Bill of Materials (BOM) for hardware required for each site provisioned, ensuring the configuration and hardware match to meet the customer’s requirements. * Working with Customer Project Managers (CPM), provides configurations and technical leadership as a primary technical resource on IP router network technologies, traffic flows, and overall end to end network communication during the Service Delivery process. * Tests and turns up new uCPE and Wireless Backup circuits in a production environment. May recommend new practices and procedures, as necessary. * Executes test plans and logs results. Gathers supporting documentation such as installation photos and speed tests. * Interfaces with customers in regard to acceptance testing of SDN Overlay and Wireless Backup services. Executes test plans and logs results. * Develops and implements test and acceptance criteria for network elements. * Troubleshoots IP networking and security issues, providing resolutions according to established practices and procedures including executing packet captures, analyzing network performance data, reviewing security profiles, parsing log files, and understanding the customer’s desired outcome. * Interfaces with customers to resolve customer issues with their service & to understand Change of Service requests. * Interfaces with customers to help educate them on the use and functionality of their service. * Opens and updates service tickets in database/tracking system. * Expertly troubleshoots IP and Network Security issues including routing, performance, connectivity, access, network address translation, access control lists/firewall rules, and network management protocols (DHCP, DNS, etc.). * Analyze network performance metrics and identify service affecting root causes to customer chronic and systemic issues. Collaborates with customer, Development and Strategic Engineering, and SDN Service platform vendor during in-depth troubleshooting. * Executes Change of Service requests through the SDN Service platform. Validates functionality after changes made to ensure customer satisfaction. * Escalates issues in a timely fashion. Provides all relevant information, accurately entering information into trouble ticket database. * Performs deep dives and root cause analysis into customer issues looking for systemic problems. * Collaborates with Engineering and Vendor teams on resolution of systemic problems. * Coordinates and implements patches in the production environment to resolve systemic problems. * Provides feedback to and supports applications/features/products under development. Assists with the software update process for existing applications, and rollouts of software releases. * Collaborates with project stakeholders to identify tool and technical requirements to support Operations. Conducts analysis to determine integration needs. * Works with Product Development team to determine if products, features, and applications fit specification and technical requirements. * Researches, writes and edits documentation and technical requirements, including product and feature designs, evaluation test plans, test results, technical manuals and formal recommendations and reports. * Provides expertise and guidance to junior team members. * Demonstrates expert level knowledge of Internet Protocol (IP) routing and switching fundamentals (See Preferred Requirements). * Supports both standard customers as well as large/complex customers with custom designs and configurations. * Exercises judgment during incident management, site design, network configuration and network activation to ensure efficient use of time. * Displays in-depth knowledge of engineering and development methodologies, concepts, skills, and their application. * Consistent exercise of independent judgment and discretion in matters of significance. * Other duties and responsibilities as assigned. **Employees at all levels are expected to:** * Understand our Operating Principles; make them the guidelines for how you do your job. * Own the customer experience - think and act in ways that put our customers first, give them seamless digital options at every touchpoint, and make them promoters of our products and services. * Know your stuff - be enthusiastic learners, users and advocates of our game-changing technology, products and services, especially our digital tools and experiences. * Win as a team - make big things happen by working together and being open to new ideas. * Be an active part of the Net Promoter System - a way of working that brings more employee and customer feedback into the company - by joining huddles, making call backs and helping us elevate opportunities to do better for our customers. * Drive results and growth. * Support a culture of inclusion in how you work and lead. * Do what's right for each other, our customers, investors and our communities. **Disclaimer:** * This information has been designed to indicate the general nature and level of work performed by employees in this role. It is not designed to contain or be interpreted as a comprehensive inventory of all duties, responsibilities and qualifications. **Skills** Network Services, Network Technologies, Technical Knowledge, Technical Training, Troubleshooting **Compensation** This job can be performed in Colorado with a Pay Range of $98,426.32 - $162,403.44 Comcast intends to offer the selected candidate base pay within this range, dependent on job-related, non-discriminatory factors such as experience. The application window is 30 days from the date job is posted, unless the number of applicants requires it to close sooner or later. Base pay is one part of the Total Rewards that Comcast provides to compensate and recognize employees for their work. Most sales positions are eligible for a Commission under the terms of an applicable plan, while most non-sales positions are eligible for a Bonus. Additionally, Comcast provides best-in-class Benefits to eligible employees. We believe that benefits should connect you to the support you need when it matters most, and should help you care for those who matter most. That’s why we provide an array of options, expert guidance and always-on tools, that are personalized to meet the needs of your reality – to help support you physically, financially and emotionally through the big milestones and in your everyday life. Please visit the [compensation and benefits summary](https://jobs.comcast.com/benefits) on our careers site for more details. **Education** Bachelor's Degree While possessing the stated degree is preferred, Comcast also may consider applicants who hold some combination of coursework and experience, or who have extensive related professional experience. **Certifications** (if applicable) **Relevant Work Experience** 7-10 Years Comcast is an equal opportunity workplace. We will consider all qualified applicants for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, disability, veteran status, genetic information, or any other basis protected by applicable law.", "summaryDescription" : "Tier 3, Engineer 4 – Network Solutions Engineer at Comcast Business", "postedDate" : "2026-06-12T20:03:08.632", "createdAt" : "2026-06-14T20:03:08.606", "lastUpdated" : "2026-06-16T02:47:48.404", "ingestTimestamp" : "2026-06-14T20:03:08.606", "mongoId" : "6a2db03474d8ee00a0c83a95", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://comcast.wd5.myworkdayjobs.com/Comcast_Careers/job/TX---Plano-7900-Windrose-Avenue-8th-Floor/Tier-3--Engineer-4---Network-Solutions-Engineer_R438620", "salaryAnnualMin" : 98426, "salaryAnnualMax" : 162403, "salaryBand" : "75k-100k", "hasSalary" : true, "allSkills" : [ ], "skillCount" : 0, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "mid", "dataQualityScore" : 0.8888889, "_score" : 1056.7025, "daysOld" : 3, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.98 }, { "id" : "694ae6ce70f0b99d589b2804", "title" : "Security Operations and Incident Response Manager", "company" : "Hyundai Capital America", "industry" : "FinTech", "salary" : { "min" : 155000.0, "max" : 210000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Manager in Security Operations and Incident Response in Irvine, United States, adjusted for the FinTech industry and company size." }, "location" : "United States-California-Irvine", "locations" : [ "United States-California-Irvine", "
Headquarters 1 (HCA_HQ1)
3161 Michelson Dr. Ste 1900
Irvine, 92612

" ], "timestamp" : "2026-06-15T08:40:47.148", "fingerprint" : "d5f865261d9c50964a8d89f96af400da1cdb2f3eecdc20e0391203f2e5cc71a5", "source" : "taleo", "language" : "en", "applyUrl" : "https://hyundaicapital.taleo.net/careersection/ex/jobdetail.ftl?job=105024", "externalId" : "105024", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Irvine", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "33.6856969,-117.8259810" } ], "locationText" : "Irvine, California, United States", "experienceLevel" : "Manager", "technicalSkills" : "SIEM, EDR, Threat intelligence, Ransomware, Phishing, Account takeover, Forensic analysis, Automation, Cloud security, AWS, Azure, Google Cloud, Oracle Cloud, Python, PowerShell", "professionalSkills" : [ "Incident response", "Threat hunting", "Tool administration", "Rule tuning", "Vulnerability management", "IAM", "DLP", "Application security", "Risk assessment", "Operational performance" ], "hardSkillsList" : [ "Security monitoring", "Threat detection", "Alert triage", "Incident handling", "Forensic investigation", "Playbook development", "Post-incident review", "Tool configuration", "Detection rule tuning", "Automation scripting", "Cloud monitoring", "Vulnerability scanning" ], "softSkillsList" : [ "Analytical mindset", "Leadership" ], "hardSkills" : [ { "name" : "Security monitoring", "level" : "intermediate" }, { "name" : "Threat detection", "level" : "intermediate" }, { "name" : "Alert triage", "level" : "intermediate" }, { "name" : "Incident handling", "level" : "intermediate" }, { "name" : "Forensic investigation", "level" : "intermediate" }, { "name" : "Playbook development", "level" : "intermediate" }, { "name" : "Post-incident review", "level" : "intermediate" }, { "name" : "Tool configuration", "level" : "intermediate" }, { "name" : "Detection rule tuning", "level" : "intermediate" }, { "name" : "Automation scripting", "level" : "intermediate" }, { "name" : "Cloud monitoring", "level" : "intermediate" }, { "name" : "Vulnerability scanning", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Analytical mindset" }, { "name" : "Leadership" } ], "majorSkills" : "Incident response, Security operations, Threat detection, SIEM management", "majorSkillsList" : [ "Incident response", "Security operations", "Threat detection", "SIEM management" ], "coreResponsibilities" : "Monitor security events, Analyze security events, Detect threats, Respond to threats, Tune SIEM rules, Optimize SIEM ingestion, Leverage threat intelligence, Analyze financial threats, Develop detection strategies, Triage security alerts, Correlate data, Escalate critical incidents, Lead incident response, Support incident response, Perform forensic investigations, Document findings, Create incident response playbooks, Maintain incident response playbooks, Conduct post-incident reviews, Recommend improvements, Update security controls, Coordinate with MSSP partners, Validate escalations, Provide tuning feedback, Manage security tools, Configure security tools, Ensure tool performance, Ensure tool coverage, Develop detection rules, Tune detection rules, Develop alerts, Tune alerts, Implement automation responses, Streamline tasks, Monitor cloud environments, Secure cloud environments, Protect financial data, Protect workloads, Integrate security tools, Partner with vulnerability management, Partner with IAM teams, Collaborate with IT Infrastructure, Collaborate with IT Application Teams, Collaborate with DevOps, Collaborate with IAM, Collaborate with DLP, Collaborate with Application Security, Integrate security operations, Conduct vulnerability scans", "teamCollaboration" : "Cross-functional collaboration; Collaborate with IT Infrastructure; Collaborate with IT Application Teams; Collaborate with DevOps; Collaborate with IAM; Collaborate with DLP; Collaborate with Application Security; Collaborate with threat intelligence; Collaborate with vulnerability management; Collaborate with engineering teams; Collaborate with cybersecurity architecture; Collaborate with cybersecurity engineering", "domainKnowledge" : "Financial systems; Cybersecurity; Cloud environments; MITRE framework", "domainList" : [ "financial-systems", "cybersecurity", "cloud-environments", "mitre-framework" ], "domainSpecificKnowledge" : [ "Financial systems", "Cybersecurity", "Cloud environments", "MITRE framework" ], "toolProficiency" : [ "Splunk", "NGSIEM", "EDR", "SIEM", "Firewalls", "Vulnerability scanners" ], "communicationSkills" : "Communicate risk; Communicate operational performance; Documentation skills", "documentationSkills" : "Document findings", "continuousLearning" : "Continuous learning; Staying ahead of threats; Tuition reimbursement", "problemSolvingSkills" : "Analytical mindset; Root cause analysis", "specialRequirements" : "Work at home, Office environment", "outcomesObjectives" : "Reduce false positives; Improve detection fidelity; Enhance detection strategies; Prevent recurrence", "qualificationsBasic" : "5+ years experience, Experience with SIEM platforms, Experience with EDR, Experience with threat intelligence platforms, Experience with incident response lifecycle, Experience with cybersecurity metrics, Experience with KPIs, Experience communicating risk, Experience communicating operational performance, Experience with cloud environments, Experience with automation scripts, Experience with vulnerability scanners, Experience with firewalls", "qualificationsPreferred" : "Experience with Splunk, Experience with NGSIEM, Experience with AWS, Experience with Azure, Experience with Google Cloud, Experience with Oracle Cloud, Experience with Python, Experience with PowerShell", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Who We Are Through our service brands Hyundai Motor Finance, Genesis Finance, and Kia Finance, Hyundai Capital America offers a wide range of financial products tailored to meet the needs of Hyundai, Genesis, and Kia customers and dealerships. We provide vehicle financing, leasing, subscription, and insurance solutions to over 2 million consumers and businesses. Embodying our commitment to grow, innovate, and diversify, we strive to reimagine the customer and dealer experience and launch innovative new products that broaden our market reach. We believe that success comes from within and are proud to support our team members through skill development and career advancement. Hyundai Capital America is an Equal Opportunity Employer committed to creating a diverse and inclusive culture for our workforce. We are a values-driven company dedicated to supporting both internal and external communities through volunteering, philanthropy, and the empowerment of our Employee Resource Groups. Together, we strive to be the leader in financing freedom of movement. We Take Care of Our People Along with competitive pay, as an employee of HCA, you are eligible for the following benefits: · Medical, Dental and Vision plans that include no-cost and low-cost plan options · Immediate 401(k) matching and vesting · Vehicle purchase and lease discounts plus monthly vehicle allowances · Paid Volunteer Time Off with company donation to a charity of your choice · Tuition reimbursement What to Expect The Security Operations & Incident Response (SOIR) Manager is responsible for the enterprise-wide incident response function within the Security Operations Center (SOC), ensuring rapid detection, containment, and remediation of cybersecurity threats. This role is pivotal in maintaining the integrity, confidentiality, and availability of Hyundai Capital America’s digital assets and infrastructure. This role will oversee 3 rd party vendor of incident responders and collaborate with threat intelligence, vulnerability management, and engineering teams to drive continuous improvement in detection and response capabilities. In addition, this role will create and maintain incident response playbooks and establish processes for proactive threat hunting, as well as be responsible for administration and day-to-day support of HCA EDR, SIEM, and HCA Monitoring, Threat detection, and remediation tools. What You Will Do 1. Security Monitoring & Threat Detection : · Monitor and analyze security events in real-time using SIEM platforms (e.g., Splunk, NGSIEM etc.) to detect and respond to threats targeting financial systems, such as ransomware, phishing, or account takeover. · Tune and optimize SIEM correlation rules and ingestion pipelines to reduce false positives and improve detection fidelity. · Leverage threat intelligence platforms to analyze emerging financial-specific threats, correlate intelligence with internal data, and develop actionable insights to enhance detection and prevention strategies. 2. Incident Response & Remediation : · Alert Triage: Investigate and triage security alerts, correlating data from endpoints, networks, and cloud environments to identify true positives and escalate critical incidents. · Incident Handling: Lead and support incident response activities, including containment, eradication, and recovery, for security incidents spanning the MITRE framework. · Forensic Analysis: Perform forensic investigations to determine the root cause of incidents, and document findings for audits and legal purposes. · Playbook Development: Create and maintain incident response playbooks, ensuring rapid and consistent response processes. · Post-Incident Review: Conduct post-Incident reviews to identify lessons learned, recommend improvements, and update security controls to prevent recurrence. · Coordinate with MSSP partners in a co-managed SIEM/SOC model to validate escalations and provide tuning feedback. 3. Tool Administration and Management of SOC Solutions : · Tool Administration: Manage and configure security tools, including SIEM, EDR, firewalls, and vulnerability scanners, to ensure optimal performance and coverage. · Rule Tuning: Develop and tune detection rules, signatures, and alerts to reduce false positives and improve detection accuracy in financial environments. · Automation: Implement automation responses (e.g. SOUR) scripts (e.g., Python, PowerShell) to streamline tasks like alert enrichment, incident triage, or vulnerability scans. · Cloud Security Monitoring: Monitor and secure cloud environments (e.g., AWS, Azure, Google Cloud, Oracle Cloud) using native security tools and third-party integrations, protecting financial data and workloads. · Collaborate with cybersecurity architecture & engineering team to ensure proper integration of security tools across cloud, network, and endpoint environments. · Partner with vulnerability management and IAM teams to ensure holistic security coverage. 4. Collaboration, Automation, and Innovation Activities : · Cross-Functional Collaboration: Partner with IT Infrastructure and IT Application Teams, DevOps, IAM, DLP, and Application Security teams to integrate security operations with broader cybersecurity initiatives, such as cloud migrations or fintech development. · Vulnerability Management: Collaborate with Vulnerability Management team to conduct regular vulnerability scans across networks, systems, and applications to identify weaknesses, such as unpatched software or misconfigurations and support the patching management and/or adequate remediation plan. 5. Documentation, Reporting, and Compliance Activities : · Incident Documentation: Document security incidents, investigations, and remediation actions in detail to support audits, compliance, and lessons learned. · Vulnerability and Penetration Test Reports: Produce comprehensive reports on vulnerability scans and penetration tests, including risk assessments, remediation plans, and validation results. · Metrics and Reporting: Develop and report on SOC metrics (e.g., Mean Time to Detect, Mean Time to Respond, vulnerability remediation rates, penetration test coverage) to demonstrate operational effectiveness. · Runbooks and Procedures: Maintain and update SOC runbooks, standard operating procedures (SOPs), and knowledge bases for incident response, vulnerability management, and penetration testing. What You Will Bring · Minimum 5-7 years progressive experience in cybersecurity with proven knowledge in Security Operations Center practices and incident response processes; including 3+ years of experience in financial services, with a strong understanding of financial threats (e.g., fraud, data breaches) and regulations (e.g., PCI DSS, Korean SOX, GDPR) · Hands-on experience with SIEM platforms, EDR solutions, and other Monitoring and Vulnerability management tools (e.g., Splunk, Crowdstrike, Rapid 7) · Strong understanding of cyber threat landscapes, attack vectors, MITRE ATT&CK framework, and adversary tactics, techniques, and procedures · Bachelor’s degree in Computer Science, Information Security, or related field · Master’s degree preferred · Certification in one of the following: CISSP, CCSP, CISM, TOGAF or equivalent · Demonstrated ability to manage major incident investigations, including root cause analysis, executive reporting, and coordination with legal, compliance, and law enforcement when necessary · Familiarity with regulatory and compliance frameworks such as HIPAA, PCI-DSS, NIST, ISO 27001, and GDPR. · Proven ability to develop and maintain incident response playbooks, escalation procedures, and SOC standard operating procedures (SOPs) · Experience with cybersecurity metrics and KPIs, and the ability to communicate risk and operational performance to executive leadership · Demonstrated expertise in incident response lifecycle, including detection, triage, containment, eradication, recovery, and post-incident review · Analytical mindset with attention to detail · Excellent communication and documentation skills · Ability to work under pressure and manage multiple incidents simultaneously · Passion for continuous learning and staying ahead of emerging threats Work Environment Employees in this class are subject to extended periods of sitting, standing, and walking, vision to monitor and moderate noise levels. Work is performed in an at home and office environment. The posted salary range for this job takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; licensure and certifications; geographic location, and other business and organizational needs. Successful candidates may be hired anywhere in the salary range based on these factors. It is uncommon to hire candidates at or near the top of the range. California Privacy Notice This notice only applies to our applicants who reside in the State of California. The latest version of our Privacy Policy can be found here . This Privacy Policy provides you with notice, at or before the point of collection, about the categories of personal information to be collected from you, the purposes for which your personal information is collected or used, and whether that information is sold or shared, so that you can exercise meaningful control over our use of your personal information. We are providing this notice to comply with the California Consumer Privacy Act of 2018, as amended as amended by the California Privacy Rights Act of 2020 (“CCPA”). If you have any questions about CCPA regarding California residents or HCA team members, please contact the Privacy Team at Privacy2@hcs.com . United States-California-Irvine", "summaryDescription" : "Security Operations and Incident Response Manager at Hyundai Capital America. Skills: Incident response, Security operations, Threat detection, SIEM management. Monitor security events. Analyze security events", "createdAt" : "2026-06-14T08:13:57.992", "lastUpdated" : "2026-06-15T08:40:47.148", "ingestTimestamp" : "2026-06-14T08:13:57.992", "mongoId" : "694ae6ce70f0b99d589b2804", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 155000, "salaryAnnualMax" : 210000, "salaryBand" : "150k-200k", "hasSalary" : true, "allSkills" : [ "Security monitoring", "Threat detection", "Alert triage", "Incident handling", "Forensic investigation", "Playbook development", "Post-incident review", "Tool configuration", "Detection rule tuning", "Automation scripting", "Cloud monitoring", "Vulnerability scanning", "Analytical mindset", "Leadership", "Incident response", "Security operations", "SIEM management", "Threat hunting", "Tool administration", "Rule tuning", "Vulnerability management", "IAM", "DLP", "Application security", "Risk assessment", "Operational performance", "Financial systems", "Cybersecurity", "Cloud environments", "MITRE framework", "Splunk", "NGSIEM", "EDR", "SIEM", "Firewalls", "Vulnerability scanners" ], "skillCount" : 36, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Manager", "dataQualityScore" : 0.7777778, "_score" : 1050.0118, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "FinTech", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2a660774d8ee00a062b91f", "title" : "Incident Management Engineer (Portuguese/English bilingual), Incident Detection and Response", "company" : "Amazon Web Services", "industry" : "Operations, IT, Support Engineering, Cloud Computing", "salary" : { "min" : 175000.0, "max" : 245000.0, "currency" : "AUD", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market data for a Senior Incident Management Engineer in Sydney, Australia, adjusted for the technology industry and a large company size." }, "location" : "Sydney, New South Wales, AUS", "locations" : [ "Sydney, New South Wales, AUS" ], "certifications" : [ "AWS Associate level certifications" ], "timestamp" : "2026-06-15T03:55:52.053", "fingerprint" : "25ae37cc0beb9911eb9aef47f1c37b8ceda01b802af3283a76e5dbf14e970920", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10443072/apply", "externalId" : "c7b14860-3b9e-4d9a-9511-058ca0f602ec", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Sydney", "state" : "New South Wales", "country" : "Australia", "continent" : "oc", "source" : "llm", "workMode" : "onsite", "geo" : "-33.8698439,151.2082848" } ], "locationText" : "Sydney, New South Wales, Australia", "employmentType" : "FULL_TIME", "technicalSkills" : "AWS", "professionalSkills" : [ "Incident Management", "Customer Ownership", "Account Ownership", "Problem Solving", "Strategic Planning" ], "hardSkillsList" : [ "Incident Response", "Customer Engagement", "Technical Troubleshooting", "Process Improvement" ], "softSkillsList" : [ "Leadership", "Mentoring", "Critical thinking" ], "hardSkills" : [ { "name" : "Incident Response", "level" : "intermediate" }, { "name" : "Customer Engagement", "level" : "intermediate" }, { "name" : "Technical Troubleshooting", "level" : "intermediate" }, { "name" : "Process Improvement", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" }, { "name" : "Mentoring" }, { "name" : "Critical thinking" } ], "majorSkills" : "Incident Management, Customer Support, Technical Resolution", "majorSkillsList" : [ "Incident Management", "Customer Support", "Technical Resolution" ], "coreResponsibilities" : "Drive resolution of customer impacting incidents, Drive customer escalations, Provide incident response/management, Lead calls with participants, Contribute to Problem Records, Conduct real-time proactive monitoring, Prioritize and manage customer issues, Monitor communications during high impact events, Collaborate with AWS stakeholders, Improve customer experience, Develop operational excellence mechanisms, Lead projects to drive improvements, Create and review design, Influence new standard operating procedures, Identify and troubleshoot platform issues, Own projects to drive improvements, Mentor peers, Perform other duties", "teamCollaboration" : "Collaboration with Engineering Teams; Work with key stakeholders", "projectManagementSkills" : [ "Project management" ], "domainKnowledge" : "Mission critical applications; Distributed architectures", "domainList" : [ "mission-critical-applications", "distributed-architectures" ], "domainSpecificKnowledge" : [ "Mission critical applications", "Distributed architectures" ], "communicationSkills" : "Written communication; Verbal communication; Oral communication; Professional communication", "documentationSkills" : "Develop runbooks; Develop response plans", "problemSolvingSkills" : "Analytical acumen; Dive deep to solve complex problems; Logical problem solving", "specialRequirements" : "Work weekends, Work public holidays", "outcomesObjectives" : "Reduce potential for failure; Accelerate recovery of critical workloads", "qualificationsBasic" : "Business level Portuguese and English, 3+ years Major Incident / Problem Manager Experience, 5+ years Support Engineering, Network Engineering, Solutions Architecture, or similar IT role, Bachelor's degree in CS, Info Sci/Tech, Comm Eng, Business, or related field (or 6+ years relevant work experience)", "qualificationsPreferred" : "AWS Associate level certifications, Knowledge of ITIL/Lean Processes, Ability to work in ambiguous environments, Demonstrated critical thinking and logical problem solving skills, Experience driving collaborative projects, Familiarity operating or designing distributed architectures, Ability to review technical details and convey to stakeholders", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Amazon has built a reputation for excellence with a mission to be the earth’s most customer-centric company, a company that customers from all over the globe will recognize, value, and trust for both our products and our service. Amazon Web Services (AWS) is carrying on that tradition while leading the world in cloud technologies. The AWS Incident Detection and Response team is part of the ASPIRE organisation within AWS Support, and is dedicated to offering eligible AWS Enterprise Support customers proactive engagement and incident management to reduce the potential for failure and to accelerate recovery of critical workloads from disruption. We achieve these objectives by working closely with customers to develop runbooks and response plans customized to the context of each workload onboarded to the service. Onboarded workloads are monitored 24x7 by a team of Incident Management Engineers (IMEs) to detect and engage customers on a call bridge within 5 minutes of a critical alarm. ABOUT YOU Incident Management Engineers have a broad skill set with demonstrated career progression and a proven track record of delivering results. The successful candidate will possess strong analytical acumen, solid technology experience, superb business judgment, strategic account ownership and a propensity to dive deep to solve complex problems. You will also have a passion for creating/providing a world class experience for our customers. The candidate must understand the competitive and industry landscape and must have the leadership presence and communication skills to effectively work with customers at all levels of their organization. You must be a self-starter and able to execute at both a tactical and strategic level – with a strong attention to detail. This is a global role that requires excellent written and verbal communication skills and a passion and desire for leading the resolution of critical incidents. Your decisions are not only fundamental to helping protect our most critical customers but will help maintain the health of AWS customers worldwide. Finally, you are passionate about technology with a desire to learn more and do more with AWS. ABOUT THE ROLE AWS Support is looking for a leader with a strong background in Incident Management and customer ownership to be there during the moments that matter for our most critical customers. We are looking for an Incident Management Engineer to join our team to provide incident response and account ownership. In this position, you will play a pivotal role in providing communication, emergency response, technical resolver engagement and incident management for our customers. Please note as a follow-the-sun organisation, IMEs work the core hours of 9am-5pm AEST. Successful applicants will be required to work some weekends (Sunday to Thursday, or Tuesday to Saturday), and public holidays. Key job responsibilities - Every day will bring new and exciting challenges that include elements of: - Drive the resolution of large scale customer impacting incidents as part of a team rotation - Drive critical, complex customer escalations in situations that are sometimes technically challenging in collaboration with Engineering Teams. - Provide critical incident response/management (including leading calls with internal/external participants) for customer’s critical workloads - Contribute to Problem Records for customers - Conduct continuous real-time proactive monitoring of customer metrics - Prioritize, manage, and own emerging and developing customer issues from start to finish - Monitor and manage communications during high impact events via relevant channels - Collaborate with key stakeholders across AWS to improve the customer experience and develop mechanisms that support operational excellence - Lead projects and teams to drive operational improvements - Create and review documentation; design/influence new standard operating procedures - Identify and troubleshoot recurring platform issues and own projects to drive improvements - Mentor peers in your areas of technical and operational strength - Perform other duties as required by the organization About the team Diverse Experiences AWS values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why AWS? Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopted cloud platform. We pioneered cloud computing and never stopped innovating — that’s why customers from the most successful startups to Global 500 companies trust our robust suite of products and services to power their businesses. Inclusive Team Culture Here at AWS, it’s in our nature to learn and be curious. Our employee-led affinity groups foster a culture of inclusion that empower us to be proud of our differences. Ongoing events and learning experiences, including our Conversations on Race and Ethnicity (CORE) and AmazeCon (gender diversity) conferences, inspire us to never stop embracing our uniqueness. Mentorship & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, mentorship and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve in the cloud. Basic Qualifications: - Business level Portuguese and English, verbal and written - 3+ years demonstrable Major Incident / Problem Manager Experience for organizations that run mission critical applications - 5+ years of experience in Support Engineering, Network Engineering, Solutions Architecture, or similar IT role. - Bachelor’s degree in Computer Science, Information Science/Technology, Communications Engineering, Business, or a related field (or 6+ years of relevant work experience) - Professional oral and written communication skills, presenting to an audience containing one or more executive team member(s) Preferred Qualifications: - Industry specific accredited certification(s) such as the AWS Associate level certifications - Knowledge of ITIL/Lean Processes - Ability to work in ambiguous environments - Demonstrated critical thinking and logical problem solving skills - Experience driving collaborative projects from conception to delivery - Familiarity operating or designing distributed architectures with the ability to correlate system behaviors based on known inter-dependencies - Ability to review complex technical details regarding ongoing issues/events and convey the key details to senior stakeholders to facilitate real-time decision making Acknowledgement of country: In the spirit of reconciliation Amazon acknowledges the Traditional Custodians of country throughout Australia and their connections to land, sea and community. We pay our respect to their elders past and present and extend that respect to all Aboriginal and Torres Strait Islander peoples today. IDE statement: Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Incident Management Engineer (Portuguese/English bilingual), Incident Detection and Response at Amazon Web Services. Skills: Incident Management, Customer Support, Technical Resolution. Drive resolution of customer impacting incidents. Drive customer escalations", "postedDate" : "2026-06-13T08:34:45.450", "createdAt" : "2026-06-13T08:34:45.450", "lastUpdated" : "2026-06-15T03:55:52.053", "ingestTimestamp" : "2026-06-13T08:34:45.450", "mongoId" : "6a2a660774d8ee00a062b91f", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10443072/apply", "salaryBand" : "150k-200k", "hasSalary" : false, "allSkills" : [ "Incident Response", "Customer Engagement", "Technical Troubleshooting", "Process Improvement", "Leadership", "Mentoring", "Critical thinking", "Incident Management", "Customer Support", "Technical Resolution", "Customer Ownership", "Account Ownership", "Problem Solving", "Strategic Planning", "Project management", "Mission critical applications", "Distributed architectures", "AWS Associate level certifications" ], "skillCount" : 18, "jobCategory" : "operations", "dataQualityScore" : 0.8888889, "_score" : 1045.93, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Cloud Technologies" }, { "id" : "6a2c5dc974d8ee00a08de8af", "title" : "Cyber Incident Response Team - Tier 2 Shift Lead", "company" : "SkyePoint Decisions", "industry" : "Cybersecurity", "salary" : { "min" : 115000.0, "max" : 155000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "The estimation is based on the market baseline for a Cyber Incident Response Team - Tier 2 Shift Lead in Beltsville, United States, adjusted for lead seniority and the cybersecurity industry." }, "location" : "8101 Odell Rd, Laurel, MD", "locations" : [ "8101 Odell Rd", "Laurel", "MD" ], "certifications" : [ "CASP+ CE", "CCISO", "CCNA Cyber Ops", "CCNA Security", "CCNP Security", "CEH", "CFR", "CISA", "CISM", "CISSP", "CISSP (or Associate)", "CISSP-ISSAP", "CISSP-ISSEP", "Cloud+", "CySA+", "GCED", "GCIA", "GCIH", "GICSP", "GSLC", "SCYER", "Azure SC-900", "CCSP", "CCSK", "GSEC", "CHFI", "GCLD", "SecurityX/CASP+", "PRMP", "GREM", "GEIR", "GNFA", "GCFA" ], "timestamp" : "2026-06-14T23:54:56.615", "fingerprint" : "6ccdd238111f347d9c5313312d8cbff67227e25822653d24973b2f4456eff202", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://job-boards.greenhouse.io/skyepointdecisionsinc/jobs/4230415009", "externalId" : "4230415009", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Beltsville", "state" : "Maryland", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "39.0397735,-76.9271851" } ], "locationText" : "Beltsville, Maryland, United States", "employmentType" : "CONTRACT", "experienceMinYears" : 8, "experienceMaxYears" : 15, "experienceLevel" : "Lead", "technicalSkills" : "SOAR platforms, SIEM platforms, EDR solutions, Cloud security, IOCs, APT actors, Malware analysis, MITRE ATT&CK, D3FEND, Splunk, Microsoft Azure, Microsoft Defender, Python, PowerShell, BASH scripting", "professionalSkills" : [ "Incident response lifecycle", "Automated response workflows", "Cyber threat intelligence", "Adversary tactics", "Techniques", "Procedures", "Malware analysis techniques", "Digital forensics", "Threat hunting" ], "hardSkillsList" : [ "Forensic analysis", "Malware analysis", "Scripting languages" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Forensic analysis", "level" : "intermediate" }, { "name" : "Malware analysis", "level" : "intermediate" }, { "name" : "Scripting languages", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident response, Cybersecurity, Malware analysis, Threat intelligence", "majorSkillsList" : [ "Incident response", "Cybersecurity", "Malware analysis", "Threat intelligence" ], "coreResponsibilities" : "Detect cyber security events, Classify cyber security events, Process cyber security events, Track cyber security events, Report on cyber security events, Perform advanced analysis of Tier 1 alerts, Analyze logs from multiple sources, Identify suspicious activity, Contain suspicious activity, Remediate suspicious activity, Characterize network traffic, Analyze network traffic, Identify anomalous activity, Identify potential threats, Protect against cyber security threats, Prevent cyber security threats, Protect against vulnerabilities, Prevent vulnerabilities, Perform forensic analysis of hosts artifacts, Perform forensic analysis of network traffic, Perform forensic analysis of email content, Analyze malicious scripts, Analyze malicious code, Mitigate potential threats, Conduct malware analysis, Generate IOCs, Identify threats, Mitigate threats, Collaborate with Department of State teams, Analyze events, Respond to events, Analyze incidents, Respond to incidents, Monitor CIRT SOAR platform, Respond to CIRT SOAR platform, Monitor CIRT hotline, Respond to CIRT hotline, Monitor CIRT email in-boxes, Respond to CIRT email in-boxes, Create tickets, Initiate workflows, Coordinate incident information, Report incident information to CISA, Collaborate with local CIRTs, Collaborate with national CIRTs, Collaborate with international CIRTs, Submit alert tuning requests, Review Tier 2 shift tickets, Coordinate with CIRT Watch Officers, Coordinate with government leadership, Provide technical improvement recommendations, Provide procedural improvement recommendations, Assist with Tier 2 candidate interviews, Ensure coordinated remediation actions operate properly", "teamCollaboration" : "Department of State teams; Local CIRTs; National CIRTs; International CIRTs; CIRT Watch Officers; Government leadership", "domainKnowledge" : "Cybersecurity Architecture; Critical Infrastructure; Federal Strategic Cyber Mission; Cloud security monitoring; Incident response; Indicators of compromise; Advanced persistent threat; Malware analysis techniques; MITRE ATT&CK; D3FEND frameworks", "domainList" : [ "cybersecurity-architecture", "critical-infrastructure", "federal-strategic-cyber-mission", "cloud-security-monitoring", "incident-response", "indicators-of-compromise", "advanced-persistent-threat", "malware-analysis-techniques", "mitre-att-ck", "d3fend-frameworks" ], "domainSpecificKnowledge" : [ "Cybersecurity Architecture", "Critical Infrastructure", "Federal Strategic Cyber Mission", "Cloud security monitoring", "Incident response", "Indicators of compromise", "Advanced persistent threat", "Malware analysis techniques", "MITRE ATT&CK", "D3FEND frameworks" ], "toolProficiency" : [ "ServiceNow", "Splunk SOAR", "Microsoft Sentinel", "Elastic", "QRadar", "Elastic XDR", "Carbon Black", "CrowdStrike", "Autopsy", "Axiom MagnetForensics", "Zimmerman-Tools", "KAPE", "CyLR", "Volatility" ], "continuousLearning" : "Certification incentive program", "problemSolvingSkills" : "Root cause analysis", "specialRequirements" : "Tuesday - Saturday, 2pm - 10pm shift, Active Secret security clearance, U. S. Citizenship", "qualificationsBasic" : "Bachelor’s degree and minimum of 11 years of relevant experience, Master’s degree with minimum of 9 years of relevant experience, PhD with 6 years of relevant experience, Active Secret security clearance, CASP+ CE certification, CCISO certification, CCNA Cyber Ops certification, CCNA Security certification, CCNP Security certification, CEH certification, CFR certification, CISA certification, CISM certification, CISSP certification, CISSP Associate certification, CISSP-ISSAP certification, CISSP-ISSEP certification, Cloud+ certification, CySA+ certification, GCED certification, GCIA certification, GCIH certification, GICSP certification, GSLC certification, SCYER certification, Demonstrated experience across incident response lifecycle, Experience with SOAR platforms, Experience with automated response workflows, Experience with SIEM platforms, Experience with EDR solutions, Knowledge of cloud security monitoring, Knowledge of incident response, Knowledge of integrating IOCs, Knowledge of tracking APT actors, Ability to analyze cyber threat intelligence, Understand adversary TTPs, Knowledge of malware analysis techniques, Familiarity with MITRE ATT&CK framework, Familiarity with D3FEND framework, U. S. Citizenship required", "qualificationsPreferred" : "Proficiency with Splunk, Experience using Microsoft Azure access, Experience using Microsoft Azure identity management, Proficiency in Microsoft Defender for Endpoint, Proficiency in Microsoft Defender for Identity, Experience using digital forensics collection tools, Experience using digital forensics analysis tools, Experience using ServiceNow SOAR, Experience using Python scripting, Experience using PowerShell scripting, Experience using BASH scripting, Proficiency in cloud security monitoring, Proficiency in incident response, Demonstrated ability to perform static malware analysis, Demonstrated ability to perform dynamic malware analysis, Demonstrated ability to perform reverse engineering, Experience with integrating cyber threat intelligence, Experience with IOC-based hunting, Azure SC-900 certification, CCSP certification, GCIH certification, CCSK certification, GSEC certification, CHFI certification, GCLD certification, GCIA certification, SecurityX certification, CASP+ certification, PRMP certification, GREM certification, GEIR certification, GNFA certification, GCFA certification", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "SkyePoint Decisions is a leading Cybersecurity Architecture and Engineering, Critical Infrastructure and Operations, and Applications Development and Maintenance IT service provider headquartered in Dulles, Virginia with operations across the U. S. We provide innovative enterprise-wide solutions as well as targeted services addressing the complex challenges faced by our federal government clients. Our focus is on enabling our clients to deliver their mission most efficiently and effectively – anytime, anywhere, securely. We combine technical expertise, mission awareness, and an empowered workforce to produce meaningful results. This is a contingent position based upon customer approval. SkyePoint Decisions is seeking an experienced Tier 2 Shift Lead for the Cyber Incident Response Team to support our customer's Federal Strategic Cyber Mission program. This is not a remote position. This person will need the ability to work onsite in Beltsville, MD, Tuesday - Saturday, 2pm - 10pm. Responsibilities: Detect, classify, process, track, and report on cyber security events and incidents. Perform advanced in-depth analysis of coordinated Tier 1 alert triage and requests in a 24x7x365 environment. Analyze logs from multiple sources (e.g., host logs, EDR, firewalls, intrusion detection systems, servers) to identify, contain, and remediate suspicious activity. Characterize and analyze network traffic to identify anomalous activity and potential threats. Protect against and prevent potential cyber security threats and vulnerabilities. Perform forensic analysis of hosts artifacts, network traffic, and email content. Analyze malicious scripts and code to mitigate potential threats. Conduct malware analysis to generate IOCs to identify and mitigate threats. Collaborate with Department of State teams to analyze and respond to events and incidents. Monitor and respond to the CIRT Security Orchestration and Automation Response (SOAR) platform, hotline, email in-boxes. Create tickets and initiate workflows as instructed in technical SOPs. Coordinate and report incident information to the Cybersecurity and Infrastructure Security Agency (CISA). Collaborate with other local, national and international CIRTs as directed. Submit alert tuning requests. Additionally, as a Tier 2 Shift Lead you will: Review all Tier 2 shift tickets for accuracy and completeness Coordinate with CIRT Watch Officers and government leadership on remediation actions Provide technical and procedural improvement recommendations to CIRT leadership Assist with Tier 2 candidate technical interviews as required Ensure coordinated remediation actions are operating properly Required Qualifications: Bachelor’s degree and minimum of 11 years of relevant experience; or, Master’s degree with minimum of 9 years; or PhD with 6 years. Must have an active Secret security clearance. Must possess, or obtain prior to start date, at least one of the following certifications. Continued certification is required as a condition of employment: CASP+ CE, CCISO, CCNA Cyber Ops, CCNA Security, CCNP Security, CEH, CFR, CISA, CISM, CISSP (or Associate), CISSP-ISSAP, CISSP-ISSEP, Cloud+, CySA+, GCED, GCIA, GCIH, GICSP, GSLC, SCYER. Demonstrated experience across the incident response lifecycle. Experience with SOAR platforms and automated response workflows (e.g., ServiceNow, Splunk SOAR, Microsoft Sentinel). Experience with Security Information and Event Management (SIEM) platforms (e.g., Splunk, Microsoft Sentinel, Elastic, QRadar). Experience with Endpoint Detection and Response (EDR) solutions (e.g., Microsoft Defender for Endpoint, Elastic XDR, Carbon Black, CrowdStrike). Knowledge of cloud security monitoring and incident response. Knowledge of integrating indicators of compromise (IOCs) and tracking advanced persistent threat (APT) actors. Ability to analyze cyber threat intelligence and understand adversary tactics, techniques, and procedures (TTPs). Knowledge of malware analysis techniques. Familiarity with MITRE ATT&CK and D3FEND frameworks. U. S. Citizenship required. Preferred Qualifications: Proficiency with Splunk for security monitoring, alert creation, and threat hunting. Experience using Microsoft Azure access and identity management. Proficiency in Microsoft Defender for Endpoint and Identity for security monitoring, response, and alert generations. Experience using digital forensics collection and analysis tools (e. g. Autopsy, Axiom MagnetForensics, Zimmerman-Tools, KAPE, CyLR, Volatility). Experience using ServiceNow SOAR for ticketing and automated response. Experience using Python, PowerShell and BASH scripting languages. Proficiency in cloud security monitoring and incident response. Demonstrated ability to perform static/dynamic malware analysis and reverse engineering. Experience with integrating cyber threat intelligence and IOC-based hunting. Technical certifications such as: Azure SC-900, CCSP, GCIH, CCSK, GSEC, CHFI, GCLD, GCIA. Advanced technical certifications such as: SecurityX/CASP+, PRMP, GREM, GEIR, GNFA, or GCFA. Compensation: Salary Range: $140,000 - $160,000 The SkyePoint Decisions salary range for this position is a general guideline only. It represents an estimated range for this position and is just one piece of our total compensation package. Salary at SkyePoint is determined by various factors, including but not limited to location, work schedule, the candidate’s combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability, market data and business considerations. In addition to a competitive salary, SkyePoint offers benefits including a certification incentive program, PTO, floating federal holiday options, several insurance options including HMO and High Deductible plans with Health Savings Accounts [HSAs], Flex Spending Accounts [FSAs], Full Dental Plans, Vision, ST/LT Disability, Life Insurance, and 401k matched. What We Can Offer You: At SkyePoint, we go B.I. G. (beginning in GRATITUDE) by recognizing all we have and giving back to our employees, families, and communities. It instills a positive mindset that permeates all we do. By beginning in gratitude, SkyePoint can continue to spread living in gratitude each day. Great Benefits: Several insurance options including HMO and High Deductible plans with Health Savings Accounts [HSAs], Flex Spending Accounts [FSAs], Full Dental Plans, ST/LT Disability, Life Insurance, floating federal holiday options, and 401k matched Certificate Incentive Program: To promote professional development, we recognize and reward employees who obtain new certifications aligned with business needs. Flexible Work Environment SkyePoint Decisions is an established ISO 9001:2015 and ISO/IEC 27001:2013 certified small business and appraised at CMMI Level 3 for Services and Development. We possess a common vision of excellence and foster a collaborative team culture built upon individual performance and accountability. We invest in our people and systems to create value for our clients. It is the SkyePoint Way. We are grateful for the opportunity to work with exceptional people and give back to the communities we serve. Our employees value the flexibility at SkyePoint that allows them to balance quality work and their personal lives. SkyePoint Decisions is a participating E-Verify Employer. U. S. Citizenship is required for most positions. Equal Opportunity Employer/Veterans/Disabled. CCPA Disclosure Notice Here", "summaryDescription" : "Cyber Incident Response Team - Tier 2 Shift Lead at SkyePoint Decisions. Skills: Incident response, Cybersecurity, Malware analysis, Threat intelligence. Detect cyber security events. Classify cyber security events", "postedDate" : "2026-06-12T21:36:11.274", "createdAt" : "2026-06-12T21:36:11.274", "lastUpdated" : "2026-06-14T23:54:56.615", "ingestTimestamp" : "2026-06-12T21:36:11.274", "mongoId" : "6a2c5dc974d8ee00a08de8af", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 115000, "salaryAnnualMax" : 155000, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Forensic analysis", "Malware analysis", "Scripting languages", "Leadership", "Incident response", "Cybersecurity", "Threat intelligence", "Incident response lifecycle", "Automated response workflows", "Cyber threat intelligence", "Adversary tactics", "Techniques", "Procedures", "Malware analysis techniques", "Digital forensics", "Threat hunting", "Cybersecurity Architecture", "Critical Infrastructure", "Federal Strategic Cyber Mission", "Cloud security monitoring", "Indicators of compromise", "Advanced persistent threat", "MITRE ATT&CK", "D3FEND frameworks", "CASP+ CE", "CCISO", "CCNA Cyber Ops", "CCNA Security", "CCNP Security", "CEH", "CFR", "CISA", "CISM", "CISSP", "CISSP (or Associate)", "CISSP-ISSAP", "CISSP-ISSEP", "Cloud+", "CySA+", "GCED", "GCIA", "GCIH", "GICSP", "GSLC", "SCYER", "Azure SC-900", "CCSP", "CCSK", "GSEC", "CHFI", "GCLD", "SecurityX/CASP+", "PRMP", "GREM", "GEIR", "GNFA", "GCFA", "ServiceNow", "Splunk SOAR", "Microsoft Sentinel", "Elastic", "QRadar", "Elastic XDR", "Carbon Black", "CrowdStrike", "Autopsy", "Axiom MagnetForensics", "Zimmerman-Tools", "KAPE", "CyLR", "Volatility" ], "skillCount" : 71, "jobCategory" : "other", "jobSubcategory" : "billable-", "dataQualityScore" : 1.0, "_score" : 1032.8854, "daysOld" : 2, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Cybersecurity" }, { "id" : "6a2cc3ac74d8ee00a0a0a0cb", "title" : "Incident Management Engineer, Incident Detection and Response", "company" : "Amazon Support Services Costa Rica SRL", "industry" : "Operations, IT, Support Engineering, Cloud Computing", "salary" : { "min" : 2.4E7, "max" : 3.6E7, "currency" : "CRC", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Mid-level Incident Management Engineer in Heredia, Costa Rica, adjusted for the technology industry and company size." }, "location" : "Heredia, Heredia, CRI", "locations" : [ "Heredia, Heredia, CRI" ], "certifications" : [ "AWS Associate level certification", "AWS Professional level certification" ], "timestamp" : "2026-06-15T11:37:34.226", "fingerprint" : "5d9fa2a124987689dce9a3778556aa78ee2ede923573d115e5b96c169fc67d88", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10448063/apply", "externalId" : "31abe20c-5f53-4481-9de0-d8720e3bd201", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Heredia", "state" : "Heredia", "country" : "Costa Rica", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "9.9984272,-84.1171215" } ], "locationText" : "Heredia, Heredia, Costa Rica", "employmentType" : "FULL_TIME", "minimumEducation" : "Bachelor's", "experienceMinYears" : 3, "experienceMaxYears" : 5, "experienceLevel" : "Mid", "technicalSkills" : "AWS", "professionalSkills" : [ "Incident Management", "Customer ownership", "Account ownership" ], "hardSkillsList" : [ "Incident response", "Technical resolution" ], "hardSkills" : [ { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Technical resolution", "level" : "intermediate" } ], "majorSkills" : "Incident Management, Incident Response, Customer Engagement", "majorSkillsList" : [ "Incident Management", "Incident Response", "Customer Engagement" ], "coreResponsibilities" : "Drive resolution large scale incidents, Provide critical incident response, Lead calls internal/external participants, Monitor manage communications high impact events, Collaborate key stakeholders AWS, Improve customer experience, Develop mechanisms support operational excellence, Create review design procedures, Influence new standard operating procedures, Identify troubleshoot recurring platform issues, Own projects drive improvements, Mentor peers technical strength, Mentor peers operational strength", "teamCollaboration" : "Engineering Teams; Key stakeholders AWS", "domainKnowledge" : "Mission critical applications; Critical workloads", "domainList" : [ "mission-critical-applications", "critical-workloads" ], "domainSpecificKnowledge" : [ "Mission critical applications", "Critical workloads" ], "communicationSkills" : "Written communication; Verbal communication", "documentationSkills" : "Runbooks; Response plans", "problemSolvingSkills" : "Troubleshoot recurring issues", "specialRequirements" : "Work weekends, Work public holidays", "outcomesObjectives" : "Reduce potential for failure; Accelerate recovery critical workloads; Detect engage customers 5 minutes; Engage customers call bridge 5 minutes", "qualificationsBasic" : "Speak, write, read fluently Spanish, 3+ years systems engineering, 3+ years technical support, Bachelor's degree equivalent, Experience English communication, 3+ years Major Incident/Problem Management", "qualificationsPreferred" : "AWS Associate level certification, AWS Professional level certification, Knowledge Lean methodologies, Knowledge distributed architectures, Knowledge service-oriented architectures, Review complex technical details, Convey key details senior stakeholders", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "The AWS Incident Detection and Response team is part of the ASPIRE organization within AWS Support, and is dedicated to offering eligible AWS Enterprise Support customers proactive engagement and incident management to reduce the potential for failure and to accelerate recovery of critical workloads from disruption. We achieve these objectives by working closely with customers to develop runbooks and response plans customized to the context of each workload onboarded to the service. Onboarded workloads are monitored 24x7 by a team of Incident Management Engineers (IMEs) to detect and engage customers on a call bridge within 5 minutes of a critical alarm. AWS Support is looking for a leader with a strong background in Incident Management and customer ownership to be there during the moments that matter for our most critical customers. We are looking for an Incident Management Engineer to join our team to provide incident response and account ownership. In this position, you will play a pivotal role in providing communication, emergency response, technical resolver engagement and incident management for our customers. This is a global role that requires excellent written and verbal communication skills and a passion and desire for leading the resolution of critical incidents. Your decisions are not only fundamental to helping protect our most critical customers but will help maintain the health of AWS customers worldwide. Please note as a follow-the-sun organization. Successful applicants will be required to work some weekends (Sunday to Thursday, or Tuesday to Saturday), and public holidays. Key job responsibilities - Drive the resolution of large scale customer impacting incidents or escalations in situations that are sometimes technically challenging in collaboration with Engineering Teams. - Provide critical incident response/management (including leading calls with internal/external participants) for customer’s critical workloads - Monitor and manage communications during high impact events via relevant channels - Collaborate with key stakeholders across AWS to improve the customer experience and develop mechanisms that support operational excellence - Create and review documentation; design/influence new standard operating procedures - Identify and troubleshoot recurring platform issues and own projects to drive improvements - Mentor peers in your areas of technical and operational strength About the team Diverse Experiences AWS values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why AWS? Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopted cloud platform. We pioneered cloud computing and never stopped innovating — that’s why customers from the most successful startups to Global 500 companies trust our robust suite of products and services to power their businesses. Inclusive Team Culture Here at AWS, it’s in our nature to learn and be curious. Our employee-led affinity groups foster a culture of inclusion that empower us to be proud of our differences. Ongoing events and learning experiences, including our Conversations on Race and Ethnicity (CORE) and AmazeCon (gender diversity) conferences, inspire us to never stop embracing our uniqueness. Mentorship & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, mentorship and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve in the cloud. Basic Qualifications: - Speak, write, and read fluently in Spanish - 3+ years of systems engineering, or 3+ years of technical support experience - Bachelor's degree or equivalent, or experience in a relevant field - Experience in English-language communication skills, both written and verbal - 3+ years demonstrable Major Incident/Problem Management Experience for organizations that run mission critical applications Preferred Qualifications: - AWS Associate level certification, or AWS Professional level certification - Knowledge of Lean methodologies - Knowledge of distributed and service-oriented architectures - Ability to review complex technical details regarding ongoing issues/events and convey the key details to senior stakeholders to facilitate real-time decision making Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Incident Management Engineer, Incident Detection and Response at Amazon Support Services Costa Rica SRL. Skills: Incident Management, Incident Response, Customer Engagement. Drive resolution large scale incidents. Provide critical incident response", "postedDate" : "2026-06-12T00:00:00.000", "createdAt" : "2026-06-14T05:24:42.339", "lastUpdated" : "2026-06-15T11:37:34.226", "ingestTimestamp" : "2026-06-14T05:24:42.339", "mongoId" : "6a2cc3ac74d8ee00a0a0a0cb", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10448063/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Incident response", "Technical resolution", "Incident Management", "Incident Response", "Customer Engagement", "Customer ownership", "Account ownership", "Mission critical applications", "Critical workloads", "AWS Associate level certification", "AWS Professional level certification" ], "skillCount" : 11, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Mid", "dataQualityScore" : 1.0, "_score" : 1017.6147, "daysOld" : 3, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2ecc1474d8ee00a0eba9f5", "title" : "Multi-lingual Escalation Specialist, Global Security Operations Center", "company" : "ADCI", "industry" : "Investigation Loss Prevention, Real Estate/Facilities, amazon security", "salary" : { "min" : 1200000.0, "max" : 1800000.0, "currency" : "INR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Mid-level Multi-lingual Escalation Specialist in Bengaluru, India, adjusted for the technology industry and company size." }, "location" : "Bengaluru, Karnataka, IND", "locations" : [ "Bengaluru, Karnataka, IND" ], "timestamp" : "2026-06-16T02:10:23.322", "fingerprint" : "dfb85a9a0d489db0e925e0a4521d7bdb1b763468d03021f7ec91d3f556215b00", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10448438/apply", "externalId" : "6d386a63-f16b-4e71-898b-95f0b29c11dc", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Bengaluru", "state" : "Karnataka", "country" : "India", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "12.9767936,77.5900820" } ], "locationText" : "Bengaluru, Karnataka, India", "employmentType" : "FULL_TIME", "minimumEducation" : "High school or equivalent diploma", "professionalSkills" : [ "Incident triage", "Crisis management", "Workplace violence triage", "Information flow facilitation" ], "hardSkillsList" : [ "Alarm monitoring", "Incident triage", "Crisis management", "Workplace violence triage" ], "softSkillsList" : [ "Composure" ], "hardSkills" : [ { "name" : "Alarm monitoring", "level" : "intermediate" }, { "name" : "Incident triage", "level" : "intermediate" }, { "name" : "Crisis management", "level" : "intermediate" }, { "name" : "Workplace violence triage", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Composure" } ], "majorSkills" : "Escalation management, Incident response, Customer support", "majorSkillsList" : [ "Escalation management", "Incident response", "Customer support" ], "coreResponsibilities" : "Provide support to delivery associates, Provide support to customers, Research and troubleshoot with internal tools, Triage and prioritize incoming incidents, Collaborate with crisis management leadership, Transfer lower severity calls to appropriate partner, Manage phone communications, Facilitate information flow between internal and external customers, Write clear and concise reports", "teamCollaboration" : "Cross-functional coordination; Vendor management; Stakeholder management", "domainKnowledge" : "Global Security Operations; Security and operational risks; Physical assets; Brand protection; Alarm monitoring; Incident triage; Crisis management; Workplace violence", "domainList" : [ "global-security-operations", "security-and-operational-risks", "physical-assets", "brand-protection", "alarm-monitoring", "incident-triage", "crisis-management", "workplace-violence" ], "domainSpecificKnowledge" : [ "Global Security Operations", "Security and operational risks", "Physical assets", "Brand protection", "Alarm monitoring", "Incident triage", "Crisis management", "Workplace violence" ], "toolProficiency" : [ "Microsoft Office", "Word", "PowerPoint", "Excel", "Outlook", "InfoPath", "SharePoint" ], "communicationSkills" : "Oral skills; Writing skills", "documentationSkills" : "Report writing", "problemSolvingSkills" : "Troubleshooting", "specialRequirements" : "Shift work required, Nights, weekends, and public holidays", "qualificationsBasic" : "High school or equivalent diploma, Knowledge of Microsoft Office products, Work a flexible schedule/shift/work area, Experience in an IT/operations/call/command center work environment, Read, write and speak Telugu, Hindi and English", "qualificationsPreferred" : "Experience in resolving conflicts, Experience providing crisis management triage, Experience setting appropriate expectations with customers, Experience multitasking, Answering multiple phone lines, Prioritize e-mail, instant message, and ticket related communication, Communicate clearly within a command center environment, 6+ months of customer service experience, Answering multiple phone lines in a Command Center work environment, Ticket related communication in a Command Center work environment, Intermediate fluency in Telugu, Intermediate fluency in Hindi, Intermediate fluency in English, Bachelor’s degree, Experience working in fast paced environments, Managing workload even during times of stress", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "The mission of Amazon Global Security Operations Centre (GSOC) is to mitigate security and operational risks to our associates, physical assets, and brand. GSOC supports Amazon Worldwide Stores by providing 24/7 services including alarm monitoring and response, incident triage, and crisis management. Amazon is hiring an Escalation Specialist at GSOC- India office. The Escalation Specialist will work directly with customers, law enforcement, delivery associates, and operations to navigate and triage security and operational risks, while providing critical incident and workplace violence triage, coordination, and facilitation. Key job responsibilities • Provide support to delivery associates on-road, and customers receiving shipments or services from Amazon, by researching and troubleshooting with internal tools. • Triage and prioritize incoming incidents and collaborate with crisis management leadership. • Transfer lower severity calls, which can be a significant percentage of total call volume, to appropriate partner including Customer Service and Shipping/Delivery • Manage phone communications and facilitate the flow of information between various internal and external customers (Delivery Associates/Delivery Service Providers/Operations Managers/Customer Service Associates/Amazon Customers). • Write clear and concise reports in a timely manner which in turn will be escalated to senior leadership and stakeholders. A day in the life judgment, and be gifted at learning new technology. Demonstrating ownership, customer obsession, and concise oral and writing skills are crucial requirements for this role. Shift work will be required, including nights, weekends, and public holidays. Basic Qualifications: - High school or equivalent diploma - Knowledge of Microsoft Office products and applications, including Word, PowerPoint, Excel, Outlook, InfoPath, SharePoint, etc. - Work a flexible schedule/shift/work area, including weekends, nights, and/or holidays - Experience in an IT/operations/call/command center work environment - Can read, write and speak Telugu, Hindi and English - Demonstrates effective composure, empathy, and a positive, professional attitude Preferred Qualifications: - Experience in resolving conflicts, providing crisis management triage, and setting appropriate expectations with customers - Experience multitasking, including answering multiple phone lines, prioritize e-mail, instant message, and ticket related communication, and communicate clearly within a command center environment - 6+ months of customer service experience, to include answering multiple phone lines and ticket related communication in a Command Center work environment - Intermediate fluency in one or more of the following languages Telugu, Hindi and English - Bachelor’s degree – Preferably in Criminal Justice, Political Science, Crisis Management or Business Administration - Experience in resolving conflicts, providing crisis management triage, and setting appropriate expectations with customers - Experience working in fast paced environments, and managing workload even during times of stress, or escalated activity Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Multi-lingual Escalation Specialist, Global Security Operations Center at ADCI. Skills: Escalation management, Incident response, Customer support. Provide support to delivery associates. Provide support to customers", "postedDate" : "2026-06-14T00:00:00.000", "createdAt" : "2026-06-14T21:40:49.947", "lastUpdated" : "2026-06-16T02:10:23.322", "ingestTimestamp" : "2026-06-14T21:40:49.947", "mongoId" : "6a2ecc1474d8ee00a0eba9f5", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10448438/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Alarm monitoring", "Incident triage", "Crisis management", "Workplace violence triage", "Composure", "Escalation management", "Incident response", "Customer support", "Information flow facilitation", "Global Security Operations", "Security and operational risks", "Physical assets", "Brand protection", "Workplace violence", "Microsoft Office", "Word", "PowerPoint", "Excel", "Outlook", "InfoPath", "SharePoint" ], "skillCount" : 21, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Mid", "dataQualityScore" : 0.8888889, "_score" : 1003.2685, "daysOld" : 2, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2a764974d8ee00a065ba75", "title" : "Incident & Problem Manager", "company" : "OVO Energy", "salary" : { "min" : 33050.0, "max" : 45000.0, "currency" : "GBP", "frequency" : "yearly", "is_estimated" : false }, "location" : "Any of our offices", "locations" : [ "Any of our offices" ], "timestamp" : "2026-06-14T19:59:52.815", "fingerprint" : "b50d37f6ef3b4f7c76294251568b67fdfc0b5473f1c53de00831bc2d66d899d2", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://careers.ovo.com/?gh_jid=7959607", "externalId" : "7959607", "structuredLocations" : [ { "city" : "Bristol", "country" : "United Kingdom", "continent" : "eu", "source" : "llm", "workMode" : "hybrid", "geo" : "51.4538022,-2.5972985" }, { "city" : "Glasgow", "country" : "United Kingdom", "continent" : "eu", "source" : "llm", "workMode" : "hybrid", "geo" : "55.8611550,-4.2501687" } ], "locationText" : "Bristol, United Kingdom; Glasgow, United Kingdom", "employmentType" : "FULL_TIME", "experienceMinYears" : 2, "experienceMaxYears" : 5, "experienceLevel" : "Mid-level/Experienced", "technicalSkills" : "BigQuery", "professionalSkills" : [ "Incident management", "Problem management", "Process management", "Stakeholder management", "Performance targets", "Operational strategy" ], "hardSkillsList" : [ "Root cause analysis", "Data analysis", "Incident resolution", "Problem resolution", "Service delivery" ], "softSkillsList" : [ "Decisive", "Co-ordinated", "Systematic", "Resilience", "Communication", "Pragmatic approach" ], "hardSkills" : [ { "name" : "Root cause analysis", "level" : "intermediate" }, { "name" : "Data analysis", "level" : "intermediate" }, { "name" : "Incident resolution", "level" : "intermediate" }, { "name" : "Problem resolution", "level" : "intermediate" }, { "name" : "Service delivery", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Decisive" }, { "name" : "Co-ordinated" }, { "name" : "Systematic" }, { "name" : "Resilience" }, { "name" : "Communication" }, { "name" : "Pragmatic approach" } ], "majorSkills" : "Incident management, Problem management, Stakeholder communication", "majorSkillsList" : [ "Incident management", "Problem management", "Stakeholder communication" ], "coreResponsibilities" : "Contribute to incident management processes, Drive performance to lowest optimised cost, Manage incidents and problems to resolution, Engage with OVO Retail business, Capture Smart Infrastructure related incidents, Engage and communicate to stakeholders, Provide Incident Management service 24/7, Coordinate investigation and resolution activities, Ensure fault resolution within agreed timescales, Manage major incidents, Support, manage, coordinate organisations, Offer timely advice and expertise, Develop and maintain common processes, Own Smart Incident Management processes, Review SLAs and targets, Provide quality reports, Input into Problem Management process, Establish authority for decision-making, Assign decision rights, Liaise and support cross-functional teams, Ensure company meets performance targets, Educate and influence stakeholders, Provide updates on operational strategy, Ensure escalation reaches right teams, Maintain data integrity for incidents, Manage incidents across smart metering infrastructure, Run post-incident reviews, Translate technical findings into preventative measures, Define and implement anomaly detection thresholds, Triage technical issues, Manage tickets, Prioritise, categorise, and route tickets, Monitor performance metrics", "teamCollaboration" : "Cross-functional teams; Smart Care; Field Operations; Platform; Delivery; Finance; Business teams; Third-party organisations", "projectManagementSkills" : [ "ITIL" ], "domainKnowledge" : "Smart journey; Smart infrastructure; Smart metering; Retail regulatory requirements", "domainList" : [ "smart-journey", "smart-infrastructure", "smart-metering", "retail-regulatory-requirements" ], "domainSpecificKnowledge" : [ "Smart journey", "Smart infrastructure", "Smart metering", "Retail regulatory requirements" ], "toolProficiency" : [ "BigQuery", "Jira" ], "communicationSkills" : "Presenting complex data; Written communication; Oral communication", "documentationSkills" : "Detailed reports", "problemSolvingSkills" : "Complex riddles; Root cause investigations", "specialRequirements" : "Paid standby cover, 24/7 service", "outcomesObjectives" : "Fault resolution within agreed timescales; Ensure company meets performance targets; Ensure escalation reaches right teams; Rapid resolution and minimal impact on customers; Actionable, long-term preventative measures; Proactively flag smart device alerts; Proactively flag infrastructure irregularities", "qualificationsBasic" : "Incident Management service for Smart system or asset emergencies 24/7 (paid standby cover), Manage major incidents, Partner and liaise with OVO’s internal business teams and third-party providers, Use data tools like BigQuery to query operational data, Triage technical issues and manage tickets, Monitor performance metrics, Deliver quality in a best practice, process driven, service orientated framework (e.g. ITIL), Work in a high pressure, multi-platform environment, Offer excellent written and oral communication skills, Experience in presenting complex data to all levels of leadership simply, Provide analytical/technical aptitude, Competent communicator and enabler, Comfortable at juggling multiple things at once", "qualificationsPreferred" : "Google Suite, BigQuery, Jira", "remoteFriendly" : true, "workSiteFlexibility" : "Hybrid", "rawDescription" : "Role OVO-View Team: Smart Infrastructure Team Location: Hub Based - Hybrid for all Salary banding: £33050 - £45000 Experience: Mid-level/Experienced Working pattern: Full-Time Reporting to: Sam Bowman - Senior Incident Manager Sponsorship: Unfortunately we are unable to offer sponsorship for this role. This role in 3 words: A mix of resilience, communication, and a responsive pragmatic approach. Top 3 qualities for this role: Decisive, co-ordinated, systematic Where you’ll work: Depending on the needs of your business area, we expect hub based people to be in the office at least once a week, and to go to OVO Connection events in-person. You’ll be assigned to the closest one of our three hub offices, Bristol, Glasgow, or London; unless your role requires field-based work. Each hub has accessible spaces to park your laptop, is designed to inspire people, help them connect and bring big ideas to life. Everyone belongs at OVO: At OVO, we are on a mission to solve one of humanity's biggest challenges, the climate crisis. And we know it takes all of us to change the world. That's why we need diverse people from all abilities, gender identities, ethnicities, ages, sexual orientations, life experiences and backgrounds to join us. Teamworking for the planet: Everything we do here spins around Plan Zero. So, naturally, the team you’ll be joining plays a gigantic role in making that happen. Here’s how: This role belongs to the high-energy executioner. They are people who don't freeze under pressure and actually get a small adrenaline rush when things go sideways. This role also belongs to the analytical deep-thinker. They are people who get genuinely annoyed by repetitive, sloppy issues and love solving complex riddles. This role in a nutshell: The Incident Manager will contribute to the development, expansion and delivery of all incident management processes for the smart journey across OVO. They will also contribute significantly to driving performance to the lowest optimised cost without negatively impacting customer satisfaction and respecting all regulatory requirements across Retail. Incident and Problem Management (OVO systems, assets and processes) to resolution Engagement with the wider OVO Retail business to ensure capture of Smart Infrastructure related incidents. Engagement of and communication to stakeholders during management of issues. Providing an Incident Management service for Smart system or asset emergencies 24/7 (paid standby cover). Your key outcomes will be: Managing Incidents and Problems - Coordinate and manage investigation and resolution activities by Business, IT and 3rd party organisations to ensure fault resolution (either a workaround or permanent solution) within agreed timescales. - Management of major Incidents, supporting, managing, co-ordinating Business, IT and 3rd party organisations Effective Incident and Problem management - Play a key role within Smart Infrastructure offering timely advice and expertise to peers and wider Smart Delivery Team - Proactively develop and maintain common and consistent processes and procedures - Ownership of the Smart Incident Management processes. - Regular review (and revision, where necessary) of SLAs and targets. - Provide quality, detailed reports and input into the Problem Management process. Effectively influence within OVO Metering - Establishes authority and flow for decision-making; assigns decision rights as it relates to incident management to inform better ways of working - Liaise and support cross-functional teams (Smart Care and Field Operations, Platform, Delivery and Finance) to ensure the company meets performance targets - Educate and influence stakeholders via training and updates on changes related to operational strategy for incident management, ensuring escalation reach the right teams promptly. Maintain data integrity for incidents throughout the systems and reporting tools Foster a culture aligned to OVO’s strategic aims build the best place to work, deserve our customers trust and mobilised and zero carbon community Delivering against the three key priority areas - Get the basics right - Drive simplicity - Deliver plan zero Focusing on completing integration, delivering smart, working safely and providing the best service for our customers. Within your first 3 months you’ll: Have successfully managed major incidents across our smart metering infrastructure, ensuring rapid resolution and minimal impact on our customers Have run or actively contributed to post-incident reviews (retrospectives), translating complex technical findings into actionable, long-term preventative measures Have defined and implemented key anomaly detection thresholds to proactively flag smart device alerts and infrastructure irregularities before they escalate Be regularly partnering and liaising with OVO’s internal business teams and third-party providers, serving as a key collaborator to resolve complex, multi-party incidents and systemic problems Be comfortable using data tools like BigQuery to query operational data and effectively pull the insights needed to drive root-cause investigations Have become highly adept at triaging technical issues and managing tickets, ensuring smooth prioritisation, categorisation, and routing within our queues Be regularly monitoring our performance metrics to track the overall health, reliability, and SLA compliance of our systems Systems: Kaluza, uSmart, DCC, FSM, Google Suite, BigQuery, Jira You’ll be a successful Role Title here at OVO if you… Deliver quality in a best practice, process driven, service orientated framework (e. g. ITIL) Able to work in a high pressure, multi-platform environment. Offer excellent written and oral communication skills, experience in presenting complex data to all levels of leadership simply Provide strong analytical/technical aptitude Competent communicator and enabler Are comfortable at juggling multiple things at once! Whether it’s applications, candidates, roles or collaborators - there will be a lot of variety; you’re able to keep on top of it all and are prompt in delivery. Let’s talk about what’s in it for you: We’ll pay you between £33050 and £45000, depending on your specific skills and experience. We keep our pay ranges broad on purpose to give us, and you, flexibility to match your experience to our zero carbon mission. You’ll be eligible for an on-target bonus of 15%. We have one OVO bonus plan that focuses on the collective performance of our people to deliver our Plan Zero goal. We also offer plenty of green benefits and progressive policies to help you feel like you belong at OVO…and there’s flex pay. We'll give you 9% Flex Pay on top of your salary – 4% of this is auto enrolled into your pension, and the remaining 5% is yours to do what you like with. You can use this to buy from our extensive range of flexible benefits, including our green benefits which we've put at the heart of our offering, add to your pension or even take it as cash. Here’s a taster of what’s on offer: For starters, you’ll get 34 days of holiday (including bank holidays). For your health With benefits like a healthcare cash plan or private medical insurance depending on your career level, critical illness cover, life assurance, health assessments, and more For your wellbeing With gym membership, travel insurance, workplace ISA, will writing services, dental insurance, and more For your lifestyle With extra holiday buying, discount dining, home we want to make the process as easy and comfortable for you as possible.", "summaryDescription" : "Incident & Problem Manager at OVO Energy. Skills: Incident management, Problem management, Stakeholder communication. Contribute to incident management processes. Drive performance to lowest optimised cost", "postedDate" : "2026-06-11T17:52:41.832", "createdAt" : "2026-06-11T17:52:41.832", "lastUpdated" : "2026-06-14T19:59:52.815", "ingestTimestamp" : "2026-06-11T17:52:41.832", "mongoId" : "6a2a764974d8ee00a065ba75", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "30k-50k", "hasSalary" : false, "allSkills" : [ "Root cause analysis", "Data analysis", "Incident resolution", "Problem resolution", "Service delivery", "Decisive", "Co-ordinated", "Systematic", "Resilience", "Communication", "Pragmatic approach", "Incident management", "Problem management", "Stakeholder communication", "Process management", "Stakeholder management", "Performance targets", "Operational strategy", "ITIL", "Smart journey", "Smart infrastructure", "Smart metering", "Retail regulatory requirements", "BigQuery", "Jira" ], "skillCount" : 25, "jobCategory" : "customer-service", "jobSubcategory" : "customer-services", "dataQualityScore" : 1.0, "_score" : 984.50916, "daysOld" : 3, "hasLocation" : true, "hasGeo" : true }, { "id" : "6a3089aaf292fd229c094821", "title" : "[8NW] Senior SecOps Incident Response Automation Engineer", "company" : "Software Mind", "industry" : "Information Technology And Services", "salary" : { "min" : 3.5E7, "max" : 5.0E7, "currency" : "CRC", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior SecOps Incident Response Automation Engineer in San José, Costa Rica, adjusted for the FinTech industry and senior experience level." }, "location" : "San José, San José Province, CR", "locations" : [ "San José", "San José Province", "CR" ], "timestamp" : "2026-06-16T10:11:45.575", "fingerprint" : "65df1f71ef24fcafefd9c420b9edd4eb5708b68d7f9ce438053fd226a38910ba", "source" : "smartrecruiters", "language" : "en", "applyUrl" : "https://jobs.smartrecruiters.com/SoftwareMind/744000132277150--8nw-senior-secops-incident-response-automation-engineer-", "externalId" : "744000132277150", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San José", "state" : "San José Province", "country" : "Costa Rica", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "9.9327707,-84.0796144" } ], "locationText" : "San José, San José Province, Costa Rica", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 10, "experienceLevel" : "mid", "technicalSkills" : "SOAR, SIEM, APIs, Python, Panther SIEM", "professionalSkills" : [ "Automation development", "Incident response", "Data retrieval", "Data manipulation", "Data reporting", "Data management", "Data presentation" ], "hardSkillsList" : [ "SOAR automation", "Incident response workflows", "API integrations", "Scripting for automation" ], "softSkillsList" : [ "Negotiation" ], "hardSkills" : [ { "name" : "SOAR automation", "level" : "intermediate" }, { "name" : "Incident response workflows", "level" : "intermediate" }, { "name" : "API integrations", "level" : "intermediate" }, { "name" : "Scripting for automation", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Negotiation" } ], "majorSkills" : "Incident Response Automation, SOAR Platform Development, Security Operations", "majorSkillsList" : [ "Incident Response Automation", "SOAR Platform Development", "Security Operations" ], "coreResponsibilities" : "Build SOAR automated response platform, Maintain SOAR automated response platform, Support AI-enabled response, Route escalations to personnel, Build automated SOC response tools, Build automation programs, Build incident response workflows, Perform Security team tasks, Support on-call response team, Respond to security incidents", "teamCollaboration" : "Technical stakeholders; Non-technical stakeholders", "domainKnowledge" : "Fintech industry; Regulated industry environment; SOC response; SIEM; SOAR; APIs; AI/LLM response automation; DLP design; DLP tuning", "domainList" : [ "fintech-industry", "regulated-industry-environment", "soc-response", "siem", "soar", "apis", "ai-llm-response-automation", "dlp-design", "dlp-tuning" ], "domainSpecificKnowledge" : [ "Fintech industry", "Regulated industry environment", "SOC response", "SIEM", "SOAR", "APIs", "AI/LLM response automation", "DLP design", "DLP tuning" ], "toolProficiency" : [ "Torq", "Tines", "Google Sheets", "Excel" ], "communicationSkills" : "English fluency; Effective communication", "continuousLearning" : "Desire to learn AI/LLM", "problemSolvingSkills" : "Identify problems; Assess problems; Tackle problems", "specialRequirements" : "On-call response team support, Occasional off-hours support", "qualificationsBasic" : "Excellent English fluency/proficiency, SOC response experience, Experience in a fintech industry, Experience in a highly regulated industry, Experience working in a lean team, Experience working in a fast-paced technical environment, Experience designing SIEM findings, Experience implementing SIEM findings, Experience tuning SIEM findings, Experience designing SOAR findings, Experience implementing SOAR findings, Experience tuning SOAR findings, Experience configuring advanced automations, Experience with APIs, Understanding of APIs, API integrations experience, Ability to set up API connections, Using APIs to access/retrieve data, Experience with scripting for automation, Experience in data management, Experience in data manipulation, Experience in data presentation", "qualificationsPreferred" : "Python for scripting experience, AI/LLM response automation experience, DLP design experience, DLP tuning experience, Panther SIEM experience", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "We are Software Mind, an awesome team of engineers who are ready to ramp up any top-notch company’s projects! Our aim? To always be one step ahead. Become part of a multicultural company in constant growth with an excellent work environment certified by Great Place To Work! Overview Software Mind is seeking qualified candidates located in Latam to fill the role of Sr. SecOps Incident Response Automation Engineer. In addition to a competitive salary rate and a positive work environment, committed to delivering high-quality technology solutions, we also offer: * Flexible schedules * An authentic work-life balance * Payment in US Dollars About the role: Our client develops digital experiences and platforms that provide consumers with information about financial services and financial products, to help them make the best financial decisions for their unique needs. We are looking for a Senior SecOps Incident Response Automation Engineer to support the client's new, greenfield projects, and build an incident response automation program using Torq (or similar SOAR tools), manage escalations, build incident response workflows, write playbooks, and automate a wide range of manual processes. The role is part of a new team and program being built from the ground up. The role provides plenty of autonomy, and the client is looking for someone who is a high driver who is biased to take action and able to identify, assess, and tackle problems that are sometimes ambiguous. They are looking for a proactive individual with great communication skills who enjoys taking on ownership of tasks and challenges. ## Qualifications Role Responsibilities: * Help build and maintain a new SOAR automated response platform using Torq, that supports AI-enabled response and escalations to be routed to on-call personnel at appropriate times. * Build automated SOC response tools, automation programs, incident response workflows, etc. * Perform various Security team tasks as needed. * Be available to support the on-call response team, occasionally on an “as needed” basis during off-hours to respond to potential security incidents. Required Skills & Qualities: * Communication and Negotiation - excellent English fluency/proficiency is required, and candidates must be able to communicate effectively to technical and non-technical stakeholders. * SOC response experience (ideally with experience in a fintech industry or another highly regulated industry environment) * Experience working as part of a lean team in a fast-paced technical environment or organization. * Experience designing, implementing, and tuning SIEM and SOAR findings, including experience configuring advanced automations with cutting-edge tools like Torq, Tines, or similar. * Experience in data retrieval, data manipulation, and data reporting, including the following skills: * Experience working with APIs (at a minimum, having a strong understanding of APIs, API integrations, the ability to set up API connections, and using APIs to access/retrieve data). * Experience with scripting for automation * Experience in data management, manipulation, and presentation (using data in Google Sheets, Excel, and databases). Control work areas: * 90% SOC/SIEM/SOAR automation development * 5% Join the on-call response team * 5% Other ## Additional Information Nice to have: * Experience using Python for scripting * Experience with AI/LLM response automation within the area of SOC response, or at minimum, a desire and willingness to learn * Experience with DLP design and tuning * Experience with Panther SIEM", "summaryDescription" : "[8NW] Senior SecOps Incident Response Automation Engineer at Software Mind. Skills: Incident Response Automation, SOAR Platform Development, Security Operations. Build SOAR automated response platform. Maintain SOAR automated response platform", "postedDate" : "2026-06-15T19:59:33.000", "createdAt" : "2026-06-16T01:45:15.499", "lastUpdated" : "2026-06-16T10:11:45.575", "ingestTimestamp" : "2026-06-16T01:45:15.499", "mongoId" : "6a3089aaf292fd229c094821", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "SOAR automation", "Incident response workflows", "API integrations", "Scripting for automation", "Negotiation", "Incident Response Automation", "SOAR Platform Development", "Security Operations", "Automation development", "Incident response", "Data retrieval", "Data manipulation", "Data reporting", "Data management", "Data presentation", "Fintech industry", "Regulated industry environment", "SOC response", "SIEM", "SOAR", "APIs", "AI/LLM response automation", "DLP design", "DLP tuning", "Torq", "Tines", "Google Sheets", "Excel" ], "skillCount" : 28, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Senior", "dataQualityScore" : 1.0, "_score" : 970.542, "daysOld" : 0, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "FinTech", "llmIndustryConfidence" : 0.95 }, { "id" : "6a3060ccf292fd229cf93a10", "title" : "[8NW] Senior SecOps Incident Response Automation Engineer", "company" : "Software Mind", "industry" : "Information Technology And Services", "salary" : { "min" : 3.25E7, "max" : 4.55E7, "currency" : "CRC", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior SecOps Incident Response Automation Engineer in San José, Costa Rica, adjusted for the FinTech industry and senior experience level." }, "location" : "San José, San José Province, CR", "locations" : [ "San José", "San José Province", "CR" ], "timestamp" : "2026-06-16T13:03:37.150", "fingerprint" : "76d028ed9af96dea94a9ff7e0eb7d88b281ee92b2753cad916513ae94d7f099c", "source" : "smartrecruiters", "language" : "en", "applyUrl" : "https://jobs.smartrecruiters.com/SoftwareMind/744000132277150--8nw-senior-secops-incident-response-automation-engineer-", "externalId" : "744000132277150", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San José", "state" : "San José Province", "country" : "Costa Rica", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "9.9327707,-84.0796144" } ], "locationText" : "San José, San José Province, Costa Rica", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 10, "experienceLevel" : "mid", "technicalSkills" : "SOAR, SIEM, APIs, Python, Panther SIEM", "professionalSkills" : [ "Automation development", "Incident response", "Data retrieval", "Data manipulation", "Data reporting", "Data management", "Data presentation" ], "hardSkillsList" : [ "Scripting for automation", "API integrations" ], "softSkillsList" : [ "Negotiation" ], "hardSkills" : [ { "name" : "Scripting for automation", "level" : "intermediate" }, { "name" : "API integrations", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Negotiation" } ], "majorSkills" : "Incident Response Automation, SOAR Platform Development, SIEM Tuning", "majorSkillsList" : [ "Incident Response Automation", "SOAR Platform Development", "SIEM Tuning" ], "coreResponsibilities" : "Build SOAR automated response platform, Maintain SOAR automated response platform, Support AI-enabled response, Route escalations to on-call personnel, Build automated SOC response tools, Build automation programs, Build incident response workflows, Perform Security team tasks, Support on-call response team, Respond to security incidents", "teamCollaboration" : "Technical stakeholders; Non-technical stakeholders", "domainKnowledge" : "Fintech industry; Regulated industry environment", "domainList" : [ "fintech-industry", "regulated-industry-environment" ], "domainSpecificKnowledge" : [ "Fintech industry", "Regulated industry environment" ], "toolProficiency" : [ "Torq", "Tines", "Google Sheets", "Excel" ], "communicationSkills" : "English fluency", "problemSolvingSkills" : "Identify problems; Assess problems; Tackle problems", "specialRequirements" : "On-call response team support, Off-hours support", "qualificationsBasic" : "Excellent English fluency/proficiency, SOC response experience, Experience in a fintech industry, Experience in a highly regulated industry, Experience working in a lean team, Experience working in a fast-paced technical environment, Experience designing SIEM findings, Experience implementing SIEM findings, Experience tuning SIEM findings, Experience designing SOAR findings, Experience implementing SOAR findings, Experience tuning SOAR findings, Experience configuring advanced automations, Experience with APIs, Understanding of APIs, API integrations experience, Ability to set up API connections, Using APIs to access/retrieve data, Experience with scripting for automation, Experience in data management, Experience in data manipulation, Experience in data presentation, Experience using data in Google Sheets, Experience using data in Excel, Experience using data in databases", "qualificationsPreferred" : "Experience using Python for scripting, Experience with AI/LLM response automation, Desire and willingness to learn AI/LLM, Experience with DLP design, Experience with DLP tuning, Experience with Panther SIEM", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "We are Software Mind, an awesome team of engineers who are ready to ramp up any top-notch company’s projects! Our aim? To always be one step ahead. Become part of a multicultural company in constant growth with an excellent work environment certified by Great Place To Work! Overview Software Mind is seeking qualified candidates located in Latam to fill the role of Sr. SecOps Incident Response Automation Engineer. In addition to a competitive salary rate and a positive work environment, committed to delivering high-quality technology solutions, we also offer: * Flexible schedules * An authentic work-life balance * Payment in US Dollars About the role: Our client develops digital experiences and platforms that provide consumers with information about financial services and financial products, to help them make the best financial decisions for their unique needs. We are looking for a Senior SecOps Incident Response Automation Engineer to support the client's new, greenfield projects, and build an incident response automation program using Torq (or similar SOAR tools), manage escalations, build incident response workflows, write playbooks, and automate a wide range of manual processes. The role is part of a new team and program being built from the ground up. The role provides plenty of autonomy, and the client is looking for someone who is a high driver who is biased to take action and able to identify, assess, and tackle problems that are sometimes ambiguous. They are looking for a proactive individual with great communication skills who enjoys taking on ownership of tasks and challenges. ## Qualifications Role Responsibilities: * Help build and maintain a new SOAR automated response platform using Torq, that supports AI-enabled response and escalations to be routed to on-call personnel at appropriate times. * Build automated SOC response tools, automation programs, incident response workflows, etc. * Perform various Security team tasks as needed. * Be available to support the on-call response team, occasionally on an “as needed” basis during off-hours to respond to potential security incidents. Required Skills & Qualities: * Communication and Negotiation - excellent English fluency/proficiency is required, and candidates must be able to communicate effectively to technical and non-technical stakeholders. * SOC response experience (ideally with experience in a fintech industry or another highly regulated industry environment) * Experience working as part of a lean team in a fast-paced technical environment or organization. * Experience designing, implementing, and tuning SIEM and SOAR findings, including experience configuring advanced automations with cutting-edge tools like Torq, Tines, or similar. * Experience in data retrieval, data manipulation, and data reporting, including the following skills: * Experience working with APIs (at a minimum, having a strong understanding of APIs, API integrations, the ability to set up API connections, and using APIs to access/retrieve data). * Experience with scripting for automation * Experience in data management, manipulation, and presentation (using data in Google Sheets, Excel, and databases). Control work areas: * 90% SOC/SIEM/SOAR automation development * 5% Join the on-call response team * 5% Other ## Additional Information Nice to have: * Experience using Python for scripting * Experience with AI/LLM response automation within the area of SOC response, or at minimum, a desire and willingness to learn * Experience with DLP design and tuning * Experience with Panther SIEM", "summaryDescription" : "[8NW] Senior SecOps Incident Response Automation Engineer at Software Mind. Skills: Incident Response Automation, SOAR Platform Development, SIEM Tuning. Build SOAR automated response platform. Maintain SOAR automated response platform", "postedDate" : "2026-06-15T19:59:33.000", "createdAt" : "2026-06-16T00:16:53.445", "lastUpdated" : "2026-06-16T13:03:37.150", "ingestTimestamp" : "2026-06-16T00:16:53.445", "mongoId" : "6a3060ccf292fd229cf93a10", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Scripting for automation", "API integrations", "Negotiation", "Incident Response Automation", "SOAR Platform Development", "SIEM Tuning", "Automation development", "Incident response", "Data retrieval", "Data manipulation", "Data reporting", "Data management", "Data presentation", "Fintech industry", "Regulated industry environment", "Torq", "Tines", "Google Sheets", "Excel" ], "skillCount" : 19, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Senior", "dataQualityScore" : 1.0, "_score" : 970.542, "daysOld" : 0, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "FinTech", "llmIndustryConfidence" : 0.95 }, { "id" : "6a305653f292fd229cf27dba", "title" : "Security Engineer II, Security Incident Response Team (SIRT)", "company" : "Amazon.com Services LLC", "industry" : "Systems, Quality, Security Engineering, Systems Security Engineering, amazon security", "salary" : { "min" : 159000.0, "max" : 202400.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Seattle, Washington, USA", "locations" : [ "Seattle, Washington, USA" ], "timestamp" : "2026-06-16T08:11:33.016", "fingerprint" : "0987fca027bd6689942ce9706e1f89c85b280b67309ecc2a54aad3db41923465", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10443978/apply", "externalId" : "c8d18061-5e73-4845-8dc5-690328d5af3a", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Seattle", "state" : "Washington", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "47.6038321,-122.3300620" } ], "locationText" : "Seattle, Washington, United States", "employmentType" : "FULL_TIME", "experienceMinYears" : 2, "experienceMaxYears" : 5, "experienceLevel" : "Mid", "technicalSkills" : "Cloud security, Network security, Endpoint security, Vulnerability management, Incident response, SIEM, Forensics, Scripting languages, AWS, Azure, GCP", "professionalSkills" : [ "Problem solving", "Analytical thinking", "Decision making" ], "hardSkillsList" : [ "Incident analysis", "Malware analysis", "Digital forensics", "Network traffic analysis", "Log analysis" ], "hardSkills" : [ { "name" : "Incident analysis", "level" : "intermediate" }, { "name" : "Malware analysis", "level" : "intermediate" }, { "name" : "Digital forensics", "level" : "intermediate" }, { "name" : "Network traffic analysis", "level" : "intermediate" }, { "name" : "Log analysis", "level" : "intermediate" } ], "majorSkills" : "Security Incident Response, Cloud Security, Threat Detection", "majorSkillsList" : [ "Security Incident Response", "Cloud Security", "Threat Detection" ], "coreResponsibilities" : "Respond to security incidents, Investigate security breaches, Analyze security alerts, Perform digital forensics, Develop incident response playbooks, Collaborate with engineering teams, Improve security posture, Stay current with threats", "teamCollaboration" : "Cross-functional teams; Engineering teams", "domainKnowledge" : "Cloud computing; Network protocols; Operating systems; Cyber threats", "domainList" : [ "cloud-computing", "network-protocols", "operating-systems", "cyber-threats" ], "domainSpecificKnowledge" : [ "Cloud computing", "Network protocols", "Operating systems", "Cyber threats" ], "toolProficiency" : [ "SIEM tools", "Forensic tools", "Threat intelligence platforms" ], "communicationSkills" : "Incident reporting; Technical briefings", "documentationSkills" : "Incident reports; Post-incident reviews", "continuousLearning" : "Stay current with threats", "problemSolvingSkills" : "Root cause analysis; Troubleshooting", "outcomesObjectives" : "Minimize impact of incidents; Reduce incident response time; Enhance security defenses", "qualificationsBasic" : "Bachelor's degree or equivalent practical experience, 5+ years of experience in security engineering, Experience with security incident response, Experience with cloud security", "qualificationsPreferred" : "Master's degree in Computer Science or related field, Experience with scripting languages, Experience with SIEM tools, Experience with threat intelligence platforms, Experience with digital forensics", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Amazon is seeking qualified Security Engineers to join our innovative, high energy Information Security team. In this role you will work within the Amazon Security Incident Response Team (SIRT). SIRT Security Engineers respond to security events, conduct analysis of threats such as malware and intrusion attempts, and provide security services to safeguard highly sensitive data. They work hands-on with detection systems and vulnerability analysis tools to respond to potential threats to Amazon systems. SIRT Security Engineers are unique individuals prepared to relentlessly resolve security issues by gathering and analyzing event data and conducting root-cause analysis. With your technical expertise, you will be solving security challenges at scale, working to protect the applications powering the most sophisticated e-commerce platform ever built. We value broad and deep technical knowledge, specifically in the fields of forensics, malware analysis, network security, application security, threat hunting, and threat intelligence. Key job responsibilities - Responding to security incidents, and coordinating a cohesive response involving multiple teams across Amazon. - Providing security engineering solutions and support during customer-facing incidents, proactively considering the prevention of similar incidents from occurring in the future. - Assisting in the development of pragmatic solutions that achieve business requirements while maintaining an acceptable level of risk. - Identifying and recommending solutions that improve or expand Amazon’s incident response capabilities, leveraging AI approaches where suitable. - Working alongside and mentoring Information Security engineers to improve security, reduce and quickly address risk. - Evaluating the impact of current security trends, advisories, publications, and academic research to Amazon, coordinating response as necessary across affected teams. - Keeping your knowledge and skills current with the rapidly changing threat landscape. - Participating in a follow-the-sun on-call rotation. A day in the life You will be part of an operational team, which owns and drives outcomes for security issues reported through a variety of mechanisms. When not \"on deck\" for those operational duties, you will be identifying and developing solutions to consistently and efficiently handle issues. You will also work with partner security teams across Amazon to raise our security bar and delight customers. There are also training and travel opportunities due to SIRT being a global team with presence in multiple countries. About the team Diverse Experiences Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why Amazon Security At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve. Inclusive Team Culture In Amazon Security, it’s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices. Training and Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional. Basic Qualifications: - 3+ years of programming in Python, Ruby, Go, Swift, Java, .Net, C++ or similar object oriented language experience - 2+ years of scripting, programming, and security code review in a common programming language (non-internship) experience - 2+ years of troubleshooting systems issues, analyzing logs, or automating basic tasks using command line tools (non-internship) experience - Bachelor's degree in computer science or equivalent - Knowledge of networking protocols such as HTTP, DNS and TCP/IP - Knowledge of industry-based security vulnerabilities and remediation techniques Preferred Qualifications: - 2+ years of any combination of the following: threat modeling experience, secure coding, identity management and authentication, software development, cryptography, system administration and network security experience - Knowledge of command line tools to troubleshoot protocols, analyze log outputs, or automate basic tasks - Experience with AWS products and services - Experience performing security activities across one or more phases of the software development lifecycle (SDLC), such as security design review, threat modeling, secure code review, and security testing Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner. The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits . USA, WA, Seattle - 159,300.00 - 202,400.00 USD annually", "summaryDescription" : "Security Engineer II, Security Incident Response Team (SIRT) at Amazon.com Services LLC. Skills: Security Incident Response, Cloud Security, Threat Detection. Respond to security incidents. Investigate security breaches", "postedDate" : "2026-06-15T22:01:16.090", "createdAt" : "2026-06-15T22:01:16.090", "lastUpdated" : "2026-06-16T08:11:33.016", "ingestTimestamp" : "2026-06-15T22:01:16.090", "mongoId" : "6a305653f292fd229cf27dba", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10443978/apply", "salaryAnnualMin" : 159000, "salaryAnnualMax" : 202400, "salaryBand" : "150k-200k", "hasSalary" : true, "allSkills" : [ "Incident analysis", "Malware analysis", "Digital forensics", "Network traffic analysis", "Log analysis", "Security Incident Response", "Cloud Security", "Threat Detection", "Problem solving", "Analytical thinking", "Decision making", "Cloud computing", "Network protocols", "Operating systems", "Cyber threats", "SIEM tools", "Forensic tools", "Threat intelligence platforms" ], "skillCount" : 18, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Mid", "dataQualityScore" : 1.0, "_score" : 966.629, "daysOld" : 0, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.98 }, { "id" : "6a2c68fa74d8ee00a09057f9", "title" : "Assistant Manager, Cybersecurity Incident Response", "company" : "telecommunications organization", "industry" : "Cygnify", "salary" : { "min" : 120000.0, "max" : 180000.0, "currency" : "MYR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Manager-level Cybersecurity Incident Response Assistant Manager in Kuala Lumpur, Malaysia, adjusted for the telecommunications industry." }, "location" : "Kuala Lumpur, Malaysia", "locations" : [ "Kuala Lumpur, Malaysia" ], "certifications" : [ "CISSP", "GCIH", "GCIA", "CEH", "Elastic Certified Engineer" ], "timestamp" : "2026-06-15T07:44:00.220", "fingerprint" : "56e79a26aaf2e95b5e453b798552e77ada7580d02d519917696520bc1ab763d7", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/cygnify/f736808f-ea19-4fe2-8933-8ca7e3e0efd4/application", "externalId" : "f736808f-ea19-4fe2-8933-8ca7e3e0efd4", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Kuala Lumpur", "country" : "Malaysia", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "3.1516964,101.6942371" } ], "locationText" : "Kuala Lumpur, Malaysia", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 8, "experienceLevel" : "Manager", "technicalSkills" : "Elastic SIEM, Elastic Stack, Elasticsearch, Logstash, Kibana, Beats, EDR, Cloud platforms", "professionalSkills" : [ "Incident management", "Detection engineering", "Use case development", "Stakeholder coordination", "Incident reporting", "Operational excellence", "Threat detection", "Root cause analysis", "Lessons learned" ], "hardSkillsList" : [ "Log analysis", "Event correlation", "Rule creation", "Rule tuning", "Integration efforts" ], "hardSkills" : [ { "name" : "Log analysis", "level" : "intermediate" }, { "name" : "Event correlation", "level" : "intermediate" }, { "name" : "Rule creation", "level" : "intermediate" }, { "name" : "Rule tuning", "level" : "intermediate" }, { "name" : "Integration efforts", "level" : "intermediate" } ], "majorSkills" : "Incident Response, SIEM administration, Detection Engineering", "majorSkillsList" : [ "Incident Response", "SIEM administration", "Detection Engineering" ], "coreResponsibilities" : "Manage cybersecurity incidents, Achieve MTTD benchmarks, Achieve MTTR benchmarks, Administer Elastic SIEM platform, Create detection rules, Tune detection rules, Integrate SIEM, Develop detection use cases, Escalate incidents, Coordinate with stakeholders, Report incidents, Monitor alerts, Triage alerts, Investigate alerts, Refine SIEM rules, Manage Elastic Stack components, Lead integration efforts, Collaborate with IT teams, Collaborate with Network teams, Collaborate with Cloud teams, Present incident findings, Present root cause analyses, Present remediation plans, Document playbooks, Enhance SOPs, Conduct post-incident reviews, Implement lessons learned", "teamCollaboration" : "Internal stakeholders; External stakeholders; Data Engineering teams; Architecture teams; Security teams; Infrastructure teams; Tooling teams; IT teams; Network teams; Cloud teams", "domainKnowledge" : "Cybersecurity incidents; Threat patterns; Attack patterns; MITRE ATT&CK", "domainList" : [ "cybersecurity-incidents", "threat-patterns", "attack-patterns", "mitre-att-ck" ], "domainSpecificKnowledge" : [ "Cybersecurity incidents", "Threat patterns", "Attack patterns", "MITRE ATT&CK" ], "toolProficiency" : [ "Elastic SIEM", "Elastic Stack", "EDR", "Ticketing systems" ], "communicationSkills" : "Incident reporting; Incident discussions", "documentationSkills" : "Incident response playbooks; Standard operating procedures", "problemSolvingSkills" : "Incident investigation; Log analysis; Event correlation; Root cause analysis", "outcomesObjectives" : "Achieve MTTD benchmarks; Achieve MTTR benchmarks; Strengthen security posture", "qualificationsBasic" : "5-8 years experience, SIEM administration, Elastic Stack environments, Incident triage, Log analysis, Detection rule engineering, MITRE ATT&CK-aligned use cases, Cross-department collaboration, Incident coordination, Presentation experience, Communication experience", "qualificationsPreferred" : "CISSP, GCIH, GCIA, CEH, Elastic Certified Engineer", "remoteFriendly" : true, "rawDescription" : "We are currently partnering with a leading technology-driven telecommunications organization that is scaling rapidly to support new digital initiatives and platforms. As part of this expansion, multiple roles are open across key functions to help build, maintain, and enhance next-generation solutions. This opportunity offers exposure to large-scale systems, innovative technologies, and a collaborative environment where skills and ideas make a real impact. Accountabilities: - End-to-end management of cybersecurity incidents, ensuring timely detection, triage, investigation, and resolution - Achieving and maintaining target MTTD (Mean Time to Detect) and MTTR (Mean Time to Respond) benchmarks. - Effective administration and optimization of the Elastic SIEM platform, including rule creation, tuning, and integrations. - Development of accurate and relevant detection use cases aligned with evolving threat patterns and organizational needs. - Ensuring timely escalation and coordination with internal and external stakeholders during major incidents. - Providing transparent and comprehensive incident reporting to leadership and relevant teams. - Drive operational excellence through monitoring, alerting, timely investigation and continuous fine tuning the alerts - Partner with Data Engineering, Architecture, Security, Infrastructure & Tooling teams to ensure aligned technical cyber security discussions Responsibilities: - Monitor, triage, and investigate alerts from multiple log sources (network, endpoint, cloud, and application). - Create, refine, and manage SIEM detection rules to capture the latest attack patterns. - Conduct log analysis and event correlation to identify potential intrusions or malicious behavior. - Drive use case ideation and validation to improve threat detection coverage and accuracy. - Manage and maintain Elastic Stack components (Elasticsearch, Logstash, Kibana, Beats) for operational efficiency. - Lead integration efforts with tools such as EDR, firewalls, cloud platforms, and ticketing systems. - Collaborate with IT, Network, and Cloud teams for incident follow-up, containment, and recovery. - Present incident findings, root cause analyses, and remediation plans to key stakeholders (internal leadership and external partners). - Document and enhance incident response playbooks and standard operating procedures (SOPs). - Conduct post-incident reviews and implement lessons learned to strengthen the organization's security posture. Requirements - 5-8 years of experience in Security Operations Center (SOC), Incident Response, or Detection Engineering roles. - Proven success in SIEM administration, particularly Elastic Stack (ELK) environments. - Hands-on expertise in incident triage, log analysis, and detection rule engineering. - Demonstrated ability to design and operationalize MITRE ATT&CK-aligned use cases. - Experience in cross-department collaboration and incident coordination with IT and business teams. - Strong presentation and communication experience in stakeholder-level incident discussions. - Relevant certifications such as CISSP,GCIH, GCIA, CEH, or Elastic Certified Engineer preferred.", "summaryDescription" : "Assistant Manager, Cybersecurity Incident Response at telecommunications organization. Skills: Incident Response, SIEM administration, Detection Engineering. Manage cybersecurity incidents. Achieve MTTD benchmarks", "createdAt" : "2026-06-13T22:02:53.611", "lastUpdated" : "2026-06-15T07:44:00.220", "ingestTimestamp" : "2026-06-13T22:02:53.611", "mongoId" : "6a2c68fa74d8ee00a09057f9", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "100k-150k", "hasSalary" : false, "allSkills" : [ "Log analysis", "Event correlation", "Rule creation", "Rule tuning", "Integration efforts", "Incident Response", "SIEM administration", "Detection Engineering", "Incident management", "Detection engineering", "Use case development", "Stakeholder coordination", "Incident reporting", "Operational excellence", "Threat detection", "Root cause analysis", "Lessons learned", "Cybersecurity incidents", "Threat patterns", "Attack patterns", "MITRE ATT&CK", "CISSP", "GCIH", "GCIA", "CEH", "Elastic Certified Engineer", "Elastic SIEM", "Elastic Stack", "EDR", "Ticketing systems" ], "skillCount" : 30, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Manager", "dataQualityScore" : 0.8888889, "_score" : 958.27606, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a307ebbf292fd229c051fab", "title" : "Lead, Incidents & Escalations, User Operations", "company" : "OpenAI", "industry" : "User Operations", "salary" : { "min" : 234000.0, "max" : 315000.0, "currency" : "USD", "frequency" : "Yearly" }, "location" : "San Francisco", "locations" : [ "San Francisco" ], "timestamp" : "2026-06-16T14:32:14.127", "fingerprint" : "99856696b5845bcab1c80262b0d5d1649aafe9a6e0a8307ff86095e046f73d56", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/OpenAI/b0729478-f363-498e-a088-b659c40d4580/application", "externalId" : "b0729478-f363-498e-a088-b659c40d4580", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San Francisco", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "hybrid", "geo" : "37.7879363,-122.4075201" } ], "locationText" : "San Francisco, California, United States", "employmentType" : "FULL_TIME", "experienceMinYears" : 8, "experienceMaxYears" : 15, "experienceLevel" : "Lead", "remoteFriendly" : true, "workSiteFlexibility" : "Flexible", "rawDescription" : "ABOUT THE TEAM OpenAI’s User Operations team shepherds our customers’ adoption of AI and ensures that our customers' product experience is nothing short of exceptional. We are building the very first post-AGI support team. We resolve complex issues, provide technical guidance, and support customers in maximizing value and adoption from deploying our products. We work closely with Sales, Technical Success, Product, Engineering and others, to deliver the best possible experience to our customers at scale. OpenAI's customers represent a range of diverse backgrounds and maturity, from early-stage startups to established global enterprises. ABOUT THE ROLE We are looking for a hands-on lead to build and run OpenAI's Incidents & Escalations function within User Operations. This is a player-coach role with a meaningful hands-on operating component. You will set the operating model and also step into active incidents and urgent escalations when needed, coordinating with on-call teams, driving clear ownership, supporting communications, and ensuring issues move through resolution and post-incident closure. During active incidents, you will coordinate with the relevant on-call teams and cross-functional responders across Engineering, Infrastructure, Support Delivery, Product, and Go-To-Market. You will help keep teams aligned, maintain timelines, clarify ownership, escalate when needed, and ensure internal, executive, customer-facing, and external communications are accurate and timely, including status page updates when required. For escalations, you will build and run the processes for tracking, triaging, mitigating, and resolving critical customer and user issues. After incidents and escalations, you will own the follow-through: retrospectives, root cause identification, action item tracking, trend analysis, and process improvements that reduce repeat issues over time. You will also help define the long-term operating model for incidents and escalations across Support Delivery, Engineering, Infrastructure, and other cross-functional partners. This role is ideal for someone who can operate calmly under pressure, bring structure to ambiguity, communicate clearly across technical and non-technical audiences, and improve the system while overseeing day to day operations. This role is based in San Francisco. We use a hybrid work model of 3 days in the office per week and offer relocation assistance to new employees. IN THIS ROLE, YOU WILL - Participate in an on-call rotation and serve as the active incident lead during live incidents and urgent escalations. - Own alert intake and triage process across support, safety, customer, and service-impacting issues. - Assess severity, determine scope and impact, and initiate the appropriate response path. - Page and coordinate Engineering, Infrastructure, Support Delivery, Product, Legal, Policy, Go-To-Market, and other teams as needed. - Lead incident response calls, manage timelines, clarify roles, and keep responders focused and unblocked. - Set internal guidelines for incident communications to all users, including enterprise customers, and own internal updates, executive briefings, customer-facing updates, and external status page updates where required. - Maintain situational awareness across all customer-facing incidents and parallel workstreams, ensuring the response remains coordinated and customer impact is understood. - Create and operate the process for monitoring, processing, mitigating, and resolving critical escalations, including formal closure and handoff. - Identify root causes behind incidents and escalations, lead retrospectives, and coordinate corrective action with accountable teams. - Track corrective actions to closure and ensure follow-through is focused on the best possible customer outcome. - Identify recurring operational issues, escalation patterns, and product or process gaps. - Partner with Engineering, Infrastructure, Product and Support leaders to stay ahead of customer-facing incidents, reduce repeat issues, and improve readiness. - Improve incident response processes, severity frameworks, playbooks, tooling, reporting, and automation. - Build a durable operating model for incidents and escalations as OpenAI scales globally. YOU MIGHT THRIVE IN THIS ROLE IF YOU - Have 10+ years of experience in incident management, technical support, escalation management, SRE, technical program management, or production operations. - Have 5+ years of hands-on experience working in production, on-call, or high-urgency operational environments. - Have 5+ years of leadership experience, ideally in a Support, Engineering, or similar environment. - Are comfortable acting as Incident Commander, owning coordination, decision-making, communication, and accountability during live incidents. - Have direct experience with customer-impacting incidents, executive escalations, safety-sensitive escalations, or high-severity technical issues. - Can communicate clearly under pressure with engineers, support teams, executives, customer-facing teams, and external stakeholders. - Have hands-on experience with incident communications, including internal updates, executive briefings, customer updates, and status pages. - Are experienced with incident management, paging, and alerting tools such as incident.io http://incident.io, PagerDuty, Datadog, Jira, Salesforce, Zendesk, or similar systems. - Understand monitoring and observability well enough to reason about alerts, system health, customer impact, and incident scope. - Can lead post-incident retrospectives that produce clear root causes, corrective actions, and durable improvements. - Drive action items to closure and hold teams accountable without creating unnecessary process drag. - Are highly organized, calm, and structured in ambiguous or high-pressure situations. - Can balance hands-on incident execution with longer-term systems building. - Are excited to use AI and automation to improve triage, routing, summarization, reporting, knowledge management, and incident follow-through. About OpenAI OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core, and to achieve our mission, we must encompass and value the many different perspectives, voices, and experiences that form the full spectrum of humanity. We are an equal opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic. For additional information, please see OpenAI’s Affirmative Action and Equal Employment Opportunity Policy Statement https://cdn.openai.com/policies/eeo-policy-statement.pdf. Background checks for applicants will be administered in accordance with applicable law, and qualified applicants with arrest or conviction records will be considered for employment consistent with those laws, including the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, for US-based candidates. For unincorporated Los Angeles County workers: we reasonably believe that criminal history may have a direct, adverse and negative relationship with the following job duties, potentially resulting in the withdrawal of a conditional offer of employment: protect computer hardware entrusted to you from theft, loss or damage; return all computer hardware in your possession (including the data contained therein) upon termination of employment or end of assignment; and maintain the confidentiality of proprietary, confidential, and non-public information. In addition, job duties require access to secure and protected information technology systems and related data security obligations. To notify OpenAI that you believe this job posting is non-compliant, please submit a report through this form https://form.asana.com/?d=57018692298241&k=5MqR40fZd7jlxVUh5J-UeA. No response will be provided to inquiries unrelated to job posting compliance. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made via this link https://form.asana.com/?k=bQ7w9h3iexRlicUdWRiwvg&d=57018692298241. OpenAI Global Applicant Privacy Policy https://cdn.openai.com/policies/global-employee-and-contractor-privacy-policy.pdf At OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.", "summaryDescription" : "Lead, Incidents & Escalations, User Operations at OpenAI", "createdAt" : "2026-06-16T01:59:53.113", "lastUpdated" : "2026-06-16T14:32:14.127", "ingestTimestamp" : "2026-06-16T01:59:53.113", "mongoId" : "6a307ebbf292fd229c051fab", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 234000, "salaryAnnualMax" : 315000, "salaryBand" : "200k+", "hasSalary" : true, "allSkills" : [ ], "skillCount" : 0, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Lead", "dataQualityScore" : 0.7777778, "_score" : 957.7336, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a3085e0f292fd229c07c507", "title" : "Lead, Incidents & Escalations, User Operations", "company" : "OpenAI", "industry" : "User Operations", "salary" : { "min" : 234000.0, "max" : 315000.0, "currency" : "USD", "frequency" : "Yearly" }, "location" : "San Francisco", "locations" : [ "San Francisco" ], "timestamp" : "2026-06-16T12:24:17.694", "fingerprint" : "4d410f347e0ada0af9167df1d611839916b669ebeed5e382975c076330af35cc", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/openai/b0729478-f363-498e-a088-b659c40d4580/application", "externalId" : "b0729478-f363-498e-a088-b659c40d4580", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San Francisco", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "hybrid", "geo" : "37.7879363,-122.4075201" } ], "locationText" : "San Francisco, California, United States", "employmentType" : "FULL_TIME", "experienceMinYears" : 8, "experienceMaxYears" : 15, "experienceLevel" : "Lead", "remoteFriendly" : true, "workSiteFlexibility" : "Flexible", "rawDescription" : "ABOUT THE TEAM OpenAI’s User Operations team shepherds our customers’ adoption of AI and ensures that our customers' product experience is nothing short of exceptional. We are building the very first post-AGI support team. We resolve complex issues, provide technical guidance, and support customers in maximizing value and adoption from deploying our products. We work closely with Sales, Technical Success, Product, Engineering and others, to deliver the best possible experience to our customers at scale. OpenAI's customers represent a range of diverse backgrounds and maturity, from early-stage startups to established global enterprises. ABOUT THE ROLE We are looking for a hands-on lead to build and run OpenAI's Incidents & Escalations function within User Operations. This is a player-coach role with a meaningful hands-on operating component. You will set the operating model and also step into active incidents and urgent escalations when needed, coordinating with on-call teams, driving clear ownership, supporting communications, and ensuring issues move through resolution and post-incident closure. During active incidents, you will coordinate with the relevant on-call teams and cross-functional responders across Engineering, Infrastructure, Support Delivery, Product, and Go-To-Market. You will help keep teams aligned, maintain timelines, clarify ownership, escalate when needed, and ensure internal, executive, customer-facing, and external communications are accurate and timely, including status page updates when required. For escalations, you will build and run the processes for tracking, triaging, mitigating, and resolving critical customer and user issues. After incidents and escalations, you will own the follow-through: retrospectives, root cause identification, action item tracking, trend analysis, and process improvements that reduce repeat issues over time. You will also help define the long-term operating model for incidents and escalations across Support Delivery, Engineering, Infrastructure, and other cross-functional partners. This role is ideal for someone who can operate calmly under pressure, bring structure to ambiguity, communicate clearly across technical and non-technical audiences, and improve the system while overseeing day to day operations. This role is based in San Francisco. We use a hybrid work model of 3 days in the office per week and offer relocation assistance to new employees. IN THIS ROLE, YOU WILL - Participate in an on-call rotation and serve as the active incident lead during live incidents and urgent escalations. - Own alert intake and triage process across support, safety, customer, and service-impacting issues. - Assess severity, determine scope and impact, and initiate the appropriate response path. - Page and coordinate Engineering, Infrastructure, Support Delivery, Product, Legal, Policy, Go-To-Market, and other teams as needed. - Lead incident response calls, manage timelines, clarify roles, and keep responders focused and unblocked. - Set internal guidelines for incident communications to all users, including enterprise customers, and own internal updates, executive briefings, customer-facing updates, and external status page updates where required. - Maintain situational awareness across all customer-facing incidents and parallel workstreams, ensuring the response remains coordinated and customer impact is understood. - Create and operate the process for monitoring, processing, mitigating, and resolving critical escalations, including formal closure and handoff. - Identify root causes behind incidents and escalations, lead retrospectives, and coordinate corrective action with accountable teams. - Track corrective actions to closure and ensure follow-through is focused on the best possible customer outcome. - Identify recurring operational issues, escalation patterns, and product or process gaps. - Partner with Engineering, Infrastructure, Product and Support leaders to stay ahead of customer-facing incidents, reduce repeat issues, and improve readiness. - Improve incident response processes, severity frameworks, playbooks, tooling, reporting, and automation. - Build a durable operating model for incidents and escalations as OpenAI scales globally. YOU MIGHT THRIVE IN THIS ROLE IF YOU - Have 10+ years of experience in incident management, technical support, escalation management, SRE, technical program management, or production operations. - Have 5+ years of hands-on experience working in production, on-call, or high-urgency operational environments. - Have 5+ years of leadership experience, ideally in a Support, Engineering, or similar environment. - Are comfortable acting as Incident Commander, owning coordination, decision-making, communication, and accountability during live incidents. - Have direct experience with customer-impacting incidents, executive escalations, safety-sensitive escalations, or high-severity technical issues. - Can communicate clearly under pressure with engineers, support teams, executives, customer-facing teams, and external stakeholders. - Have hands-on experience with incident communications, including internal updates, executive briefings, customer updates, and status pages. - Are experienced with incident management, paging, and alerting tools such as incident.io http://incident.io, PagerDuty, Datadog, Jira, Salesforce, Zendesk, or similar systems. - Understand monitoring and observability well enough to reason about alerts, system health, customer impact, and incident scope. - Can lead post-incident retrospectives that produce clear root causes, corrective actions, and durable improvements. - Drive action items to closure and hold teams accountable without creating unnecessary process drag. - Are highly organized, calm, and structured in ambiguous or high-pressure situations. - Can balance hands-on incident execution with longer-term systems building. - Are excited to use AI and automation to improve triage, routing, summarization, reporting, knowledge management, and incident follow-through. About OpenAI OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core, and to achieve our mission, we must encompass and value the many different perspectives, voices, and experiences that form the full spectrum of humanity. We are an equal opportunity employer, and we do not discriminate on the basis of race, religion, color, national origin, sex, sexual orientation, age, veteran status, disability, genetic information, or other applicable legally protected characteristic. For additional information, please see OpenAI’s Affirmative Action and Equal Employment Opportunity Policy Statement https://cdn.openai.com/policies/eeo-policy-statement.pdf. Background checks for applicants will be administered in accordance with applicable law, and qualified applicants with arrest or conviction records will be considered for employment consistent with those laws, including the San Francisco Fair Chance Ordinance, the Los Angeles County Fair Chance Ordinance for Employers, and the California Fair Chance Act, for US-based candidates. For unincorporated Los Angeles County workers: we reasonably believe that criminal history may have a direct, adverse and negative relationship with the following job duties, potentially resulting in the withdrawal of a conditional offer of employment: protect computer hardware entrusted to you from theft, loss or damage; return all computer hardware in your possession (including the data contained therein) upon termination of employment or end of assignment; and maintain the confidentiality of proprietary, confidential, and non-public information. In addition, job duties require access to secure and protected information technology systems and related data security obligations. To notify OpenAI that you believe this job posting is non-compliant, please submit a report through this form https://form.asana.com/?d=57018692298241&k=5MqR40fZd7jlxVUh5J-UeA. No response will be provided to inquiries unrelated to job posting compliance. We are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made via this link https://form.asana.com/?k=bQ7w9h3iexRlicUdWRiwvg&d=57018692298241. OpenAI Global Applicant Privacy Policy https://cdn.openai.com/policies/global-employee-and-contractor-privacy-policy.pdf At OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.", "summaryDescription" : "Lead, Incidents & Escalations, User Operations at OpenAI", "createdAt" : "2026-06-16T01:59:36.155", "lastUpdated" : "2026-06-16T12:24:17.694", "ingestTimestamp" : "2026-06-16T01:59:36.155", "mongoId" : "6a3085e0f292fd229c07c507", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 234000, "salaryAnnualMax" : 315000, "salaryBand" : "200k+", "hasSalary" : true, "allSkills" : [ ], "skillCount" : 0, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Lead", "dataQualityScore" : 0.7777778, "_score" : 957.72345, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "68c2e43bf8b1b0376634c922", "title" : "Customer Incident Response Program Manager", "company" : "Amazon Information Service", "industry" : "Project/Program/Product Management--Non-Tech, Program Management, Cloud Computing", "salary" : { "min" : 450000.0, "max" : 750000.0, "currency" : "CNY", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior Manager in the Technology industry in Shanghai, China, adjusted for company size and specific role." }, "location" : "Shanghai, CHN", "locations" : [ "Shanghai, CHN" ], "certifications" : [ "Program or Project Management Professional Certification", "AWS certifications" ], "timestamp" : "2026-06-15T04:15:54.586", "fingerprint" : "0bc8f5195ef5bedf99b540884b8f2e95e0d85ed791a728e672725e3c046681c4", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/3071459/apply", "externalId" : "1259a4c9-cf3d-4dad-ac7f-ee57866350a4", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Shanghai", "country" : "China", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "31.2312707,121.4700152" } ], "locationText" : "Shanghai, China", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceLevel" : "Manager", "technicalSkills" : "AWS, Generative AI", "professionalSkills" : [ "Security assessment", "Controls design" ], "hardSkillsList" : [ "Incident response", "Security operations" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Security operations", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident response, Program management, Security", "majorSkillsList" : [ "Incident response", "Program management", "Security" ], "coreResponsibilities" : "Manage a portfolio of critical security offerings, Manage a portfolio of critical security services, Build training programs for users, Deploy training programs for users, Brief customers on AWS CIRT, Brief customers on AWS Security Incident Response service, Prioritize risk for service teams, Prioritize risk for security teams, Prioritize risk for executive leadership, Collaborate with business teams, Collaborate with service teams, Understand security assessment scope, Confirm security assessment scope, Understand controls design, Confirm controls design", "teamCollaboration" : "Cross-functional teams; Senior leadership; Security engineers; Service teams", "projectManagementSkills" : [ "Program management", "Project management", "Roadmap management", "Strategic planning" ], "domainKnowledge" : "Cloud security; Incident response; Security operations", "domainList" : [ "cloud-security", "incident-response", "security-operations" ], "domainSpecificKnowledge" : [ "Cloud security", "Incident response", "Security operations" ], "communicationSkills" : "Executive level communication", "innovationCreativity" : "Pioneer security solutions", "problemSolvingSkills" : "Root cause analysis", "qualificationsBasic" : "8+ years program management experience, Experience using data and metrics, Experience owning program strategy, 5+ years Program or Project Management experience in Security domain, Experience managing enterprise-level projects, Experience managing continuous improvement programs", "qualificationsPreferred" : "2+ years driving process improvements, Master's degree or MBA, Experience owning cross-team security implementation programs, Experience driving operational security programs, Experience driving secure software development lifecycle programs, Experience working in security operations environment, Active project management certification, Agile management certification, AWS experience, AWS certifications", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "AWS Global Services includes experts from across AWS who help our customers design, build, operate, and secure their cloud environments. Customers innovate with AWS Professional Services, upskill with AWS Training and Certification, optimize with AWS Support and Managed Services, and meet objectives with AWS Security Assurance Services. Our expertise and emerging technologies include AWS Partners, AWS Sovereign Cloud, AWS International Product, and the Generative AI Innovation Center. You’ll join a diverse team of technical experts in dozens of countries who help customers achieve more with the AWS cloud. Do you want to work on planetary scale incident response solutions in the cloud? Are you excited to help customers respond to security incidents and automate security operations giving them unprecedented capability and agility? Do you enjoy working on fast-paced complex projects focused on game changing business outcomes for customers globally? As a member of the AWS Customer Incident Response Team (CIRT) in the AWS Global Service Security (GSS) you will have the opportunity to help customers respond to security incidents and pioneer technically superb security solutions to help customer operate securely in the cloud. Within this team, AWS CIRT is seeking a self-motivated leader with rich experience in customer service and interested in improving the way products are brought to market and distributed on a global scale to join us as a Program Manager for China. AWS CIRT is looking for a skilled and motivated senior Program Manager to expand the security program that responds to customer security incidents at scale. You will manage the roadmap and apply strong judgement that balances immediate security campaigns with longer-term, strategic planning. This role is inherently cross-functional, working closely with senior leadership, security engineers, and dozens of service teams. A successful candidate will have a good mix of deep technical security knowledge and a demonstrated track record of successful complex and large scale program/project deliveries. Key job responsibilities • A proven track record of implementing, delivering large projects and communicating effectively at executive level • Manage a portfolio of critical security offerings and services that are internal and external facing • Excellent program and project management skills, with the ability to work in a fast-paced environment • Effective prioritization of tasks, and seamless operation across organizational boundaries • Building and deploying training programs for all users in the Greater China Region • Brief customers on AWS CIRT and AWS Security Incident Response service • Continuously prioritize risk for service teams, security teams, and executive leadership • Collaborate with business/service teams to understand and confirm security assessment scope and controls design About the team This role will be to join the AWS Customer Incident Response Team (CIRT) aka Zipline - https://w.amazon.com/bin/view/AWS/Teams/GlobalServicesSecurity/TDIR/Zipline Diverse Experiences AWS values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why AWS? Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopted cloud platform. We pioneered cloud computing and never stopped innovating — that’s why customers from the most successful startups to Global 500 companies trust our robust suite of products and services to power their businesses. Inclusive Team Culture AWS values curiosity and connection. Our employee-led and company-sponsored affinity groups promote inclusion and empower our people to take pride in what makes us unique. Our inclusion events foster stronger, more collaborative teams. Our continual innovation is fueled by the bold ideas, fresh perspectives, and passionate voices our teams bring to everything we do. Mentorship & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, mentorship and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve. Basic Qualifications: - 8+ years of program or project management experience - Experience using data and metrics to determine and drive improvements - Experience owning program strategy, end to end delivery, and communicating results to senior leadership - 5+ years of Program or Project Management experience managing enterprise-level projects and continuous improvement programs in the Security domain. - Program or Project Management Professional Certification Preferred Qualifications: - 2+ years of driving process improvements experience - Master's degree, or MBA in business, operations, human resources, adult education, organizational development, instructional design or related field - Experience in owning cross-team security implementation programs inclusive of metrics, communications and prioritization. - Experience driving operational security and secure software development lifecycle programs. - Experience working in a security operations environment. - Have at least one active project or agile management certification. - AWS experience and/or relevant certifications. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Customer Incident Response Program Manager at Amazon Information Service. Skills: Incident response, Program management, Security. Manage a portfolio of critical security offerings. Manage a portfolio of critical security services", "postedDate" : "2026-06-13T10:08:25.455", "createdAt" : "2026-06-13T10:08:25.455", "lastUpdated" : "2026-06-15T04:15:54.586", "ingestTimestamp" : "2026-06-13T10:08:25.455", "mongoId" : "68c2e43bf8b1b0376634c922", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/3071459/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Incident response", "Security operations", "Leadership", "Program management", "Security", "Security assessment", "Controls design", "Project management", "Roadmap management", "Strategic planning", "Cloud security", "Program or Project Management Professional Certification", "AWS certifications" ], "skillCount" : 13, "jobCategory" : "project-management", "dataQualityScore" : 1.0, "_score" : 948.12286, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Cloud Computing" }, { "id" : "6a2c68fa74d8ee00a0905806", "title" : "Senior Incident Response Specialist, Cyber Security", "industry" : "Cygnify", "salary" : { "min" : 120000.0, "max" : 180000.0, "currency" : "MYR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior Incident Response Specialist in Kuala Lumpur, Malaysia, adjusted for the cybersecurity industry and senior experience level." }, "location" : "Kuala Lumpur, Malaysia", "locations" : [ "Kuala Lumpur, Malaysia" ], "timestamp" : "2026-06-16T02:39:21.304", "fingerprint" : "d361c038e80e7ee25f06c2708e696babafce6881749e9a55b1eb9bfeb96da610", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/cygnify/f8691c89-168e-4178-9678-8a9d39b9914d/application", "externalId" : "f8691c89-168e-4178-9678-8a9d39b9914d", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Kuala Lumpur", "country" : "Malaysia", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "3.1516964,101.6942371" } ], "locationText" : "Kuala Lumpur, Malaysia", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 10, "experienceLevel" : "Senior", "technicalSkills" : "Elastic Stack, SIEM, Cloud", "professionalSkills" : [ "Incident triage", "Log analysis", "Root cause analysis", "Use case improvements", "Detection quality", "Incident handling", "Evidence collection", "Detection workflows", "Readiness enhancement", "Log source onboarding" ], "hardSkillsList" : [ "Security alerts", "Security events", "Malware investigation", "Phishing investigation", "Insider threats", "Cloud breaches", "Detection rule creation", "Threat hunting", "Compliance reporting", "Audit support", "Simulation exercises", "Tabletop exercises" ], "hardSkills" : [ { "name" : "Security alerts", "level" : "intermediate" }, { "name" : "Security events", "level" : "intermediate" }, { "name" : "Malware investigation", "level" : "intermediate" }, { "name" : "Phishing investigation", "level" : "intermediate" }, { "name" : "Insider threats", "level" : "intermediate" }, { "name" : "Cloud breaches", "level" : "intermediate" }, { "name" : "Detection rule creation", "level" : "intermediate" }, { "name" : "Threat hunting", "level" : "intermediate" }, { "name" : "Compliance reporting", "level" : "intermediate" }, { "name" : "Audit support", "level" : "intermediate" }, { "name" : "Simulation exercises", "level" : "intermediate" }, { "name" : "Tabletop exercises", "level" : "intermediate" } ], "majorSkills" : "Incident Response, Cyber Security, SIEM platform", "majorSkillsList" : [ "Incident Response", "Cyber Security", "SIEM platform" ], "coreResponsibilities" : "Monitor security alerts, Investigate security alerts, Analyze security incidents, Contain security incidents, Escalate security incidents, Tune SIEM rules, Suggest new detections, Analyze logs, Correlate logs, Create incident documentation, Maintain incident documentation, Create incident reports, Maintain incident reports, Create lessons learned, Maintain lessons learned, Support playbook execution, Remediate incidents, Perform root cause analysis, Provide use case insights, Validate use cases, Test use cases, Escalate confirmed incidents, Participate in reviews, Improve processes, Improve detections, Validate security events, Identify legitimate threats, Investigate malware incidents, Investigate phishing incidents, Investigate insider threats, Investigate cloud breaches, Assist in rule creation, Assist in rule tuning, Map MITRE ATT&CK, Improve detection quality, Hunt threats, Handle incidents, Collect evidence, Document incidents, Support compliance, Support audits, Contribute to automation, Participate in training, Participate in simulations, Participate in exercises, Onboard log sources, Manage log availability", "teamCollaboration" : "Collaborate with IT; Collaborate with network; Collaborate with application teams; Collaborate with MSSP; Collaborate with CSIRT; Collaborate with IT infrastructure", "domainKnowledge" : "Cyber resilience; MITRE ATT&CK; Cloud breaches; Insider threats; Malware; Phishing", "domainList" : [ "cyber-resilience", "mitre-att-ck", "cloud-breaches", "insider-threats", "malware", "phishing" ], "domainSpecificKnowledge" : [ "Cyber resilience", "MITRE ATT&CK", "Cloud breaches", "Insider threats", "Malware", "Phishing" ], "toolProficiency" : [ "Elastic Stack", "SIEM" ], "documentationSkills" : "Incident documentation; Incident reports; Lessons learned; Evidence collection; Compliance documentation; Audit documentation", "continuousLearning" : "Training sessions; Simulations; Tabletop exercises", "innovationCreativity" : "Automation opportunities", "problemSolvingSkills" : "Root cause analysis; Troubleshooting", "outcomesObjectives" : "Ensure timely response; Maintain cyber resilience; Align with MTTD goals; Align with MTTR goals", "qualificationsBasic" : "Perform deep-dive investigations, Conduct threat hunting, Support incident response reporting, Manage continuous logs availability", "qualificationsPreferred" : "MITRE ATT&CK mapping, Automation opportunities", "rawDescription" : "Role Mission The Senior Analyst - Cyber Security Incident Response is responsible for monitoring, detecting, and analyzing cybersecurity incidents through the Security Operations Centre (SOC) platform. The role supports the end-to-end incident lifecycle — including triage, investigation, containment, and closure — ensuring timely response to security events and maintaining cyber resilience. This role acts as the Level 2 (L2) Incident Responder, bridging SOC analysts and Incident Response management by performing deep technical analysis and coordinating with internal teams for resolution. Accountabilities: - Perform end-to-end incident triage and investigation of security alerts escalated from L1 SOC analysts. - Ensure timely incident analysis, containment, and escalation aligned with MTTD and MTTR goals. - Support the SIEM platform (Elastic Stack) by fine-tuning existing rules and suggesting new detections. - Conduct log analysis and correlation across multiple data sources (network, endpoint, and cloud). - Create and maintain incident documentation, reports, and lessons learned. - Support incident response playbook execution during containment and recovery phases. - Collaborate with IT, network, and application teams for incident remediation and root cause analysis. - Provide insights for use case improvements and participate in use case validation and testing. - Escalate confirmed incidents to CSIRT / Assistant Manager - Incident Response for further action. - Participate in post-incident reviews, contributing to process and detection improvements. - Monitor alerts generated from the SOC/SIEM and perform initial to intermediate-level investigations. - Review and validate security events from multiple log sources and identify legitimate threats. - Perform deep-dive investigations for incidents involving malware, phishing, insider threats, and cloud breaches. - Assist in detection rule creation and tuning under the guidance of senior incident responders. - Use frameworks like MITRE ATT&CK for mapping and improving detection quality. - Conduct threat hunting using Elastic Stack and related tools. - Collaborate with MSSP, CSIRT, and IT infrastructure teams to ensure timely incident handling. - Support incident response reporting, evidence collection, and documentation for compliance and audit. - Contribute to automation opportunities in detection and response workflows. - Participate in training sessions, simulations, and tabletop exercises to enhance readiness. - Responsible for the log source onboarding and managing the continuous logs availability on the SIEM platform. Requirements - Monitor alerts generated from the SOC/SIEM and perform initial to intermediate-level investigations. - Review and validate security events from multiple log sources and identify legitimate threats. - Perform deep-dive investigations for incidents involving malware, phishing, insider threats, and cloud breaches. - Assist in detection rule creation and tuning under the guidance of senior incident responders. - Use frameworks like MITRE ATT&CK for mapping and improving detection quality. - Conduct threat hunting using Elastic Stack and related tools. - Collaborate with MSSP, CSIRT, and IT infrastructure teams to ensure timely incident handling. - Support incident response reporting, evidence collection, and documentation for compliance and audit. - Contribute to automation opportunities in detection and response workflows. - Participate in training sessions, simulations, and tabletop exercises to enhance readiness. - Responsible for the log source onboarding and managing the continuous logs availability on the SIEM platform. #LI-JE1", "summaryDescription" : "Senior Incident Response Specialist, Cyber Security. Skills: Incident Response, Cyber Security, SIEM platform. Monitor security alerts. Investigate security alerts", "createdAt" : "2026-06-14T19:11:17.518", "lastUpdated" : "2026-06-16T02:39:21.304", "ingestTimestamp" : "2026-06-14T19:11:17.518", "mongoId" : "6a2c68fa74d8ee00a0905806", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "100k-150k", "hasSalary" : false, "allSkills" : [ "Security alerts", "Security events", "Malware investigation", "Phishing investigation", "Insider threats", "Cloud breaches", "Detection rule creation", "Threat hunting", "Compliance reporting", "Audit support", "Simulation exercises", "Tabletop exercises", "Incident Response", "Cyber Security", "SIEM platform", "Incident triage", "Log analysis", "Root cause analysis", "Use case improvements", "Detection quality", "Incident handling", "Evidence collection", "Detection workflows", "Readiness enhancement", "Log source onboarding", "Cyber resilience", "MITRE ATT&CK", "Malware", "Phishing", "Elastic Stack", "SIEM" ], "skillCount" : 31, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Senior", "dataQualityScore" : 0.7777778, "_score" : 939.4183, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Cybersecurity", "llmIndustryConfidence" : 0.98 }, { "id" : "6a2c5dc974d8ee00a08de8c0", "title" : "Incident Detection/Response Manager (SOC Manager)", "company" : "SkyePoint Decisions", "industry" : "Cybersecurity", "salary" : { "min" : 100000.0, "max" : 120000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Remote", "locations" : [ "Remote" ], "certifications" : [ "GCIH", "GCFA", "GREM" ], "timestamp" : "2026-06-14T18:54:22.893", "fingerprint" : "a26d854864141b72fd7fdda9b87bab40979eb929aca80323e4f63e8519d0c0a6", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://job-boards.greenhouse.io/skyepointdecisionsinc/jobs/4240175009", "externalId" : "4240175009", "industryFunction" : { }, "structuredLocations" : [ { "workMode" : "remote" } ], "locationText" : "", "employmentType" : "CONTRACT", "minimumEducation" : "Bachelor's", "experienceMinYears" : 8, "experienceLevel" : "Manager", "technicalSkills" : "SIEM, SOAR, EDR, CDM, Malware analysis, AWS native services", "professionalSkills" : [ "Incident response", "Cybersecurity architecture", "Critical infrastructure", "Applications development", "Enterprise-wide solutions", "Mission awareness" ], "hardSkillsList" : [ "Operating systems", "Networking", "Malware analysis" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Operating systems", "level" : "intermediate" }, { "name" : "Networking", "level" : "intermediate" }, { "name" : "Malware analysis", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident detection, Incident response, SOC management", "majorSkillsList" : [ "Incident detection", "Incident response", "SOC management" ], "coreResponsibilities" : "Manage SOC daily activities, Build schedules, Update documentation, Manage incident response operations, Coordinate containment activities, Coordinate eradication activities, Coordinate recovery activities, Lead post-incident reviews, Lead root cause analysis, Ensure compliance with NIST SP 800-61, Ensure compliance with FSA incident response SOPs, Manage SIEM event dashboards, Maintain coverage schedule, Maintain call tree", "teamCollaboration" : "Partner organizations; CSPs", "projectManagementSkills" : [ "SOPs", "Playbooks", "CONOPS" ], "domainKnowledge" : "Cybersecurity; NIST SP 800-61; Incident response", "domainList" : [ "cybersecurity", "nist-sp-800-61", "incident-response" ], "domainSpecificKnowledge" : [ "Cybersecurity", "NIST SP 800-61", "Incident response" ], "toolProficiency" : [ "SIEM", "SOAR", "EDR", "CDM" ], "communicationSkills" : "Documentation", "documentationSkills" : "SOPs; Playbooks; CONOPS", "continuousLearning" : "Certification incentive program", "problemSolvingSkills" : "Root cause analysis", "specialRequirements" : "Secret clearance, U. S. Citizen", "qualificationsBasic" : "Bachelor's degree, 8+ years IT experience, 4+ years incident response, Active Secret clearance, U. S. Citizen", "qualificationsPreferred" : "GCIH certification, GCFA certification, GREM certification", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "SkyePoint Decisions is a leading Cybersecurity Architecture and Engineering, Critical Infrastructure and Operations, and Applications Development and Maintenance IT service provider headquartered in Dulles, Virginia with operations across the U. S. We provide innovative enterprise-wide solutions as well as targeted services addressing the complex challenges faced by our federal government clients. Our focus is on enabling our clients to deliver their mission most efficiently and effectively – anytime, anywhere, securely. We combine technical expertise, mission awareness, and an empowered workforce to produce meaningful results. This is a contingent position based upon contract win. SkyePoint Decisions is seeking a Incident Detection/Response Manager (SOC Manager) to join our team supporting the Department of Education’s (DoED) Federal Student Aid (FSA) Cybersecurity and Privacy Support Services (CPSS) in Washington, DC. This is a remote position. Responsibilities: Manages SOC daily activities including building schedules and making sure all documentation such as but not limited to SOPs, Playbooks, CONOPS are up to date. Manages Tiers I/II/III incident response operations. Coordinates containment, eradication, and recovery activities. Leads post-incident reviews and root cause analysis. Ensures compliance with NIST SP 800-61 and FSA incident response SOPs. Manages SIEM event “notables” dashboards. Maintains coverage schedule per shift. Maintains call tree including contact information for all partner organizations and CSPs. Required Qualifications: Bachelor's degree and 8+ years of IT experience with 4+ years in incident response. Must have at least an active Secret clearance. At least one of these certifications: GCIH, GCFA, GREM, among others. Experience with SIEM, SOAR, EDR, CDM, and malware analysis. Experience with operating systems and networking. Experience with AWS native services and tools. Experience managing SOC overseeing complex systems. Must be a U. S. Citizen. Compensation: Salary Range: $100,000-$120,000 The SkyePoint Decisions salary range for this position is a general guideline only. It represents an estimated range for this position and is just one piece of our total compensation package. Salary at SkyePoint is determined by various factors, including but not limited to location, work schedule, the candidate’s combination of education, knowledge, skills, competencies, and experience, as well as contract-specific affordability, market data and business considerations. In addition to a competitive salary, SkyePoint offers benefits including a certification incentive program, PTO, floating federal holiday options, several insurance options including HMO and High Deductible plans with Health Savings Accounts [HSAs], Flex Spending Accounts [FSAs], Full Dental Plans, Vision, ST/LT Disability, Life Insurance, and 401k matched. What We Can Offer You: At SkyePoint, we go B.I. G. (beginning in GRATITUDE) by recognizing all we have and giving back to our employees, families, and communities. It instills a positive mindset that permeates all we do. By beginning in gratitude, SkyePoint can continue to spread living in gratitude each day. Great Benefits: Several insurance options including HMO and High Deductible plans with Health Savings Accounts [HSAs], Flex Spending Accounts [FSAs], Full Dental Plans, ST/LT Disability, Life Insurance, floating federal holiday options, and 401k matched Certificate Incentive Program: To promote professional development, we recognize and reward employees who obtain new certifications aligned with business needs. Flexible Work Environment SkyePoint Decisions is an established ISO 9001:2015 and ISO/IEC 27001:2013 certified small business and appraised at CMMI Level 3 for Services and Development. We possess a common vision of excellence and foster a collaborative team culture built upon individual performance and accountability. We invest in our people and systems to create value for our clients. It is the SkyePoint Way. We are grateful for the opportunity to work with exceptional people and give back to the communities we serve. Our employees value the flexibility at SkyePoint that allows them to balance quality work and their personal lives. SkyePoint Decisions is a participating E-Verify Employer. U. S. Citizenship is required for most positions. Equal Opportunity Employer/Veterans/Disabled. CCPA Disclosure Notice Here", "summaryDescription" : "Incident Detection/Response Manager (SOC Manager) at SkyePoint Decisions. Skills: Incident detection, Incident response, SOC management. Manage SOC daily activities. Build schedules", "postedDate" : "2026-06-12T21:38:51.252", "createdAt" : "2026-06-12T21:38:51.252", "lastUpdated" : "2026-06-14T18:54:22.893", "ingestTimestamp" : "2026-06-12T21:38:51.252", "mongoId" : "6a2c5dc974d8ee00a08de8c0", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 100000, "salaryAnnualMax" : 120000, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Operating systems", "Networking", "Malware analysis", "Leadership", "Incident detection", "Incident response", "SOC management", "Cybersecurity architecture", "Critical infrastructure", "Applications development", "Enterprise-wide solutions", "Mission awareness", "SOPs", "Playbooks", "CONOPS", "Cybersecurity", "NIST SP 800-61", "GCIH", "GCFA", "GREM", "SIEM", "SOAR", "EDR", "CDM" ], "skillCount" : 24, "jobCategory" : "other", "jobSubcategory" : "billable-", "dataQualityScore" : 1.0, "_score" : 903.1788, "daysOld" : 1, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "Cybersecurity" }, { "id" : "6a30514cf292fd229cefe135", "title" : "Support Engineer - Escalation Management", "company" : "Blueprint", "salary" : { "min" : 30.0, "max" : 33.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Remote", "locations" : [ "Remote" ], "timestamp" : "2026-06-16T07:33:17.063", "fingerprint" : "7b49f6c6ceba18ccaa69fa0d5bfdcca7d5519e2dd7b63190e65e9b64b3cbe7f6", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://job-boards.greenhouse.io/notexternal/jobs/8006812", "externalId" : "8006812", "industryFunction" : { }, "structuredLocations" : [ { "country" : "Bulgaria", "continent" : "eu", "workMode" : "remote" } ], "locationText" : "Bulgaria", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "Who is Blueprint? We are a technology solutions firm headquartered in Bellevue, Washington, with a strong presence across the United States. Unified by a shared passion for solving complicated problems, our people are our greatest asset. We use technology as a tool to bridge the gap between strategy and execution, powered by the knowledge, skills, and the expertise of our teams, who all have unique perspectives and years of experience across multiple industries. We’re bold, smart, agile, and fun. What does Blueprint do? Blueprint helps organizations unlock value from existing assets by leveraging cutting-edge technology to create additional revenue streams and new lines of business. We connect strategy, business solutions, products, and services to transform and grow companies. Why Blueprint? At Blueprint, we believe in the power of possibility and are passionate about bringing it to life. Whether you join our bustling product division, our multifaceted services team or you want to grow your career in human resources, your ability to make an impact is amplified when you join one of our teams. You’ll focus on solving unique business problems while gaining hands-on experience with the world’s best technology. We believe in unique perspectives and build teams of people with diverse skillsets and backgrounds. At Blueprint, you’ll have the opportunity to work with multiple clients and teams, such as data science and product development, all while learning, growing, and developing new solutions. We guarantee you won’t find a better place to work and thrive than at Blueprint. In This Role In this role, with our client you will act as a customer advocate responsible for managing and resolving complex, high-impact escalations across cloud and enterprise products. You will coordinate with cross-functional stakeholders—including engineering, program management, and support teams—to remove blockers, drive timely resolutions, and improve the overall customer experience. You will proactively communicate with both technical and non-technical audiences, ensuring clarity on case status, risks, and next steps. This role requires strong judgment to balance customer needs with organizational policies while identifying trends, process gaps, and opportunities for continuous improvement. Key Responsibilities Manage and drive resolution of customer and partner escalations within defined SLAs Coordinate with cross-functional stakeholders (engineering, program management, technical advisors) to unblock issues Serve as a central point of communication, providing timely case updates and clear next steps Advocate for customers while balancing business policies to achieve mutually beneficial outcomes Analyze recurring or emerging issues and escalate them to appropriate teams for long-term resolution Facilitate discussions between stakeholders to mediate and resolve complex issues Prioritize and manage a high volume of cases effectively and independently Identify opportunities to improve processes and enhance the customer experience Apply strong judgment when exceptions to standard processes are necessary Participate in knowledge sharing, feedback loops, and mentorship opportunities Required Qualifications United States citizenship with an active, valid U. S. passport 5–7 years of experience in customer engagement, support operations, or related corporate services 5–7 years of experience managing escalations and working with ticketing/support systems 3+ years of experience with enterprise or cloud-based platforms (e.g., productivity suites, cloud infrastructure, or business applications) Proven ability to manage high-priority escalations and drive resolution across multiple stakeholders Strong written and verbal communication skills, including the ability to translate complex technical issues for non-technical audiences Demonstrated stakeholder management and collaboration skills Ability to work in fast-paced environments and manage competing priorities effectively Fluent in English Preferred Qualifications Experience working with cloud platforms or enterprise productivity/business applications Strong problem-solving mindset with the ability to navigate ambiguous situations Ability to influence without formal authority and build relationships across teams Customer-first mindset with strong empathy and advocacy skills Experience supporting partners or handling licensing-related issues Strong organizational skills and ability to self-direct work Confidence in decision-making with the ability to clearly articulate rationale Experience researching issues and leveraging internal knowledge bases to drive solutions Collaborative team player with a focus on shared success Salary Range At Blueprint, we strive to offer competitive pay that reflects the value of our team members. Compensation for this role is influenced by a variety of factors, including skills, education, responsibilities, experience, and geographic market. For candidates based in Washington State, the anticipated salary range is $30 – $33 USD Per Hr. Please note that we typically do not hire new employees at the top of the posted range. Actual starting pay will be determined based on experience, skills, and internal equity. The final salary and job title may vary depending on the selected candidate’s qualifications and could fall outside the stated range. Equal Opportunity Employer Blueprint Technologies, LLC is an equal employment opportunity employer. Qualified applicants are considered without regard to race, color, age, disability, sex, gender identity or expression, orientation, veteran/military status, religion, national origin, ancestry, marital, or familial status, genetic information, citizenship, or any other status protected by law. If you need assistance or a reasonable accommodation to complete the application process, please reach out to: recruiting@bpcs.com Blueprint believe in the importance of a healthy and happy team, which is why our comprehensive benefits package includes: Medical, dental, and vision coverage Flexible Spending Account 401k program Competitive PTO offerings Parental Leave Opportunities for professional growth and development Location: Remote", "summaryDescription" : "Support Engineer - Escalation Management at Blueprint", "postedDate" : "2026-06-15T23:15:41.813", "createdAt" : "2026-06-15T23:15:41.813", "lastUpdated" : "2026-06-16T07:33:17.063", "ingestTimestamp" : "2026-06-15T23:15:41.813", "mongoId" : "6a30514cf292fd229cefe135", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 62400, "salaryAnnualMax" : 68640, "salaryBand" : "50k-75k", "hasSalary" : true, "allSkills" : [ ], "skillCount" : 0, "jobCategory" : "sales", "jobSubcategory" : "customer_success", "seniorityLevel" : "Mid", "dataQualityScore" : 0.6666667, "_score" : 896.1923, "daysOld" : 0, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a307a55f292fd229c03aba6", "title" : "Manager, AV Incident Management", "company" : "May Mobility", "salary" : { "min" : 150000.0, "max" : 225000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Ann Arbor, Michigan, United States", "locations" : [ "Ann Arbor", "Michigan", "United States" ], "timestamp" : "2026-06-16T10:30:40.536", "fingerprint" : "3053d197eb8333d33227ff4e5ed999fd054ab117a0661ad9829b7a124b47c017", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://job-boards.greenhouse.io/maymobility/jobs/8587945002", "externalId" : "8587945002", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Ann Arbor", "state" : "Michigan", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "42.2813722,-83.7484616" } ], "locationText" : "Ann Arbor, Michigan, United States", "employmentType" : "FULL_TIME", "experienceLevel" : "Manager", "rawDescription" : "May Mobility is transforming cities through autonomous technology to create a safer, greener, more accessible world. Based in Ann Arbor, Michigan, May develops and deploys autonomous vehicles (AVs) powered by our innovative Multi-Policy Decision Making (MPDM) technology that literally reimagines the way AVs think. Our vehicles do more than just drive themselves - they provide value to communities, bridge public transit gaps and move people where they need to go safely, easily and with a lot more fun. We’re building the world’s best autonomy system to reimagine transit by minimizing congestion, expanding access and encouraging better land use in order to foster more green, vibrant and livable spaces. Since our founding in 2017, we’ve given more than 500,000 autonomous rides to real people around the globe. And we’re just getting started. We’re hiring people who share our passion for building the future, today, solving real-world problems and seeing the impact of their work. Join us. Job Summary The Manager, AV Incident Management is responsible for leading May Mobility's incident management function within the Systems Risk Management team. This role owns the end-to-end incident response process across our autonomous vehicle operations, ensuring every incident is identified, managed, and closed in a way that is accurate, timely, and defensible to regulators and partners. As May Mobility scales its fleet and expands toward continuous autonomous operations, this role provides the senior leadership and operational expertise needed to mature our incident management capability in line with that growth. This individual will develop and maintain the processes, standards, and team structures that keep our operations safe and our safety case credible. Essential Responsibilities Lead and continuously improve the incident management process across all AV operational sites, ensuring consistent, high-quality response to incidents of all severities Enable and support regulatory incident reporting, including NHTSA Standing General Order requirements and applicable state-level reporting, ensuring accurate and timely submissions Develop and maintain incident response standards, escalation frameworks, and operational protocols in alignment with May Mobility's safety case and risk management approach Design and lead a tiered incident response team structure that scales effectively with fleet growth, balancing full-time and contract resources to maintain coverage and quality Serve as the primary point of contact for regulators, first responders, and partners during significant incidents, coordinating response and communications in partnership with Legal and Safety leadership Work cross-functionally with Safety, Engineering, Legal, and Operations to ensure incidents drive systemic improvement, not just resolution Develop and lead the talent within the incident management team, building a clear career pathway and ensuring the team has the skills and capacity to meet operational demands Provide regular reporting to senior leadership on incident trends, team performance, and emerging risks Skills and Abilities Success in this role typically requires the following competencies: Deep understanding of AV operations and the regulatory environment governing autonomous vehicle deployment in the United States Proven ability to lead and make decisions under pressure, with clear judgment on escalation and regulatory reporting thresholds Strong process ownership instincts - able to design systems that work consistently across teams and time zones Effective communicator across technical, legal, and executive audiences Ability to build and develop a team from a small base, with a practical approach to scaling that stays ahead of operational demand High integrity in handling sensitive operational and safety information Qualifications and Experience Candidates most successful in this role typically hold the following qualifications or comparable knowledge or experience: Required Qualifications: 7+ years of experience in incident management, safety operations, or crisis management within an autonomous vehicle, aviation, rail, or similarly regulated industry Direct experience owning regulatory incident reporting to federal or state transportation authorities Demonstrated experience designing and implementing escalation structures and on-call coverage models for 24/7 operations Proven track record working across Safety, Engineering, Legal, and Operations functions at a senior level Experience building and leading small, high-performing teams in a fast-paced operational environment Desirable Qualifications: Experience at an AV company that has operated or launched driverless commercial service Background in first responder coordination and external communications during major incidents Familiarity with safety case frameworks and risk-based assessment methodologies Prior military experience, especially those with Special Operations or Officer Command roles, or equivalent Federal or State Government experience Physical Requirements Standard office working conditions which includes but not limited to: Prolonged sitting Prolonged standing Prolonged computer use Travel Required? 0-10% Benefits and Perks Comprehensive healthcare suite including medical, dental, vision, life, and disability plans. Domestic partners who have been residing together at least one year are also eligible to participate. Health Savings and Flexible Spending Healthcare and Dependent Care Accounts available. Rich retirement benefits, including an immediately vested employer safe harbor match. Generous paid parental leave as well as a phased return to work. Flexible vacation policy in addition to paid company holidays. Total Wellness Program providing numerous resources for overall wellbeing Don’t meet every single requirement? Studies have shown that women and/or people of color are less likely to apply to a job unless they meet every qualification. At May Mobility, we’re committed to building a diverse, inclusive, and authentic workforce, so if you’re excited about this role but your previous experience doesn’t align perfectly with every qualification, we encourage you to apply anyway! You may be the perfect candidate for this or another role at May. Want to learn more about our culture & benefits? Check out our website! May Mobility is an equal opportunity employer. All applicants for employment will be considered without regard to race, color, religion, sex, national origin, age, disability, sexual orientation, gender identity or expression, veteran status, genetics or any other legally protected basis. Below, you have the opportunity to share your preferred gender pronouns, gender, ethnicity, and veteran status with May Mobility to help us identify areas of improvement in our hiring and recruitment processes. Completion of these questions is entirely voluntary. Any information you choose to provide will be kept confidential, and will not impact the hiring decision in any way. If you believe that you will need any type of accommodation, please let us know. Note to Recruitment Agencies: May Mobility does not accept unsolicited agency resumes. Furthermore, May Mobility does not pay placement fees for candidates submitted by any agency other than its approved partners. Salary Range $150,000—$225,000 USD", "summaryDescription" : "Manager, AV Incident Management at May Mobility", "postedDate" : "2026-06-16T01:15:48.328", "createdAt" : "2026-06-16T01:15:48.328", "lastUpdated" : "2026-06-16T10:30:40.536", "ingestTimestamp" : "2026-06-16T01:15:48.328", "mongoId" : "6a307a55f292fd229c03aba6", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 150000, "salaryAnnualMax" : 225000, "salaryBand" : "150k-200k", "hasSalary" : true, "allSkills" : [ ], "skillCount" : 0, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Manager", "dataQualityScore" : 0.8888889, "_score" : 888.96, "daysOld" : 0, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a30511af292fd229cefa781", "title" : "Support Engineer - Escalation Management", "industry" : "Support", "salary" : { "min" : 72000.0, "max" : 108000.0, "currency" : "EUR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for Bulgaria, adjusted for Seniority and Technology industry." }, "location" : "US", "locations" : [ "US" ], "timestamp" : "2026-06-16T12:19:22.017", "fingerprint" : "1a23fdf04bf0c4a6bf4d6d5f33adf44c451c9546922a06277c202385c520f2f7", "source" : "lever", "language" : "en", "applyUrl" : "https://jobs.lever.co/jobgether/35e9dcde-4a17-47b0-bb12-d9a6b97e1d6a/apply", "externalId" : "35e9dcde-4a17-47b0-bb12-d9a6b97e1d6a", "industryFunction" : { }, "structuredLocations" : [ { "country" : "Bulgaria", "continent" : "eu", "workMode" : "remote" } ], "locationText" : "Bulgaria", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 7, "experienceLevel" : "Mid", "professionalSkills" : [ "Escalation management", "Support operations", "Customer success" ], "majorSkills" : "Escalation management, Customer support", "majorSkillsList" : [ "Escalation management", "Customer support" ], "coreResponsibilities" : "Manage customer escalations, Drive customer escalation resolution, Meet service level agreements, Meet customer expectations, Serve as primary point of contact, Provide clear communication, Provide proactive communication, Update on status, Update on risks, Update on next steps, Collaborate with engineering, Collaborate with program management, Collaborate with technical advisors, Collaborate with support teams, Remove blockers, Accelerate issue resolution, Advocate for customer needs, Balance organizational policies, Balance business objectives, Achieve effective outcomes, Analyze recurring issues, Identify root causes, Escalate trends, Support long-term improvements, Facilitate discussions, Coordinate stakeholders, Resolve challenging customer situations, Prioritize escalations, Manage high volume of escalations, Maintain high service standards, Identify opportunities to improve support processes, Identify opportunities for knowledge sharing, Identify opportunities for customer experience initiatives, Apply sound judgment, Evaluate exceptions to standard procedures, Recommend appropriate solutions, Contribute to team development, Participate in continuous improvement efforts", "teamCollaboration" : "Collaborate with engineering; Collaborate with program management; Collaborate with technical advisors; Collaborate with support teams; Coordinate stakeholders across multiple functions", "domainKnowledge" : "Enterprise software; Cloud-based platforms; Productivity suites; Business applications", "domainList" : [ "enterprise-software", "cloud-based-platforms", "productivity-suites", "business-applications" ], "domainSpecificKnowledge" : [ "Enterprise software", "Cloud-based platforms", "Productivity suites", "Business applications" ], "toolProficiency" : [ "Support ticketing systems" ], "communicationSkills" : "Explain technical concepts; Clear communication; Proactive communication", "continuousLearning" : "Professional development; Career growth opportunities", "problemSolvingSkills" : "Problem-solving skills; Analytical skills; Root cause analysis", "specialRequirements" : "United States citizenship, Valid U. S. passport", "qualificationsBasic" : "5–7 years customer engagement experience, 5–7 years escalation management experience, 5–7 years ticketing systems experience, 3 years enterprise software support, 3 years cloud-based platforms support, 3 years productivity suites support, 3 years business applications support, Manage high-priority customer issues, Coordinate resolutions across stakeholders, Excellent written communication skills, Excellent verbal communication skills, Explain technical concepts to non-technical audiences, Stakeholder management capabilities, Collaboration capabilities, Relationship-building capabilities, Work effectively in fast-paced environments, Manage competing priorities, Analytical skills, Problem-solving skills, Navigate ambiguity, Make informed decisions, Customer-focused mindset, Commitment to exceptional service, Commitment to advocacy, Organizational skills, Self-motivation, Work independently, Fluency in English", "qualificationsPreferred" : "Experience with cloud technologies, Experience with enterprise applications, Experience with licensing-related support, Experience with partner ecosystems", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "## Accountabilities Manage and drive the resolution of customer and partner escalations while ensuring service level agreements and customer expectations are met. Serve as the primary point of contact for complex support cases, providing clear, proactive communication regarding status updates, risks, and next steps. Collaborate with engineering, program management, technical advisors, and support teams to remove blockers and accelerate issue resolution. Advocate for customer needs while balancing organizational policies and business objectives to achieve effective outcomes. Analyze recurring issues, identify root causes, and escalate trends to appropriate teams to support long-term improvements. Facilitate discussions and coordinate stakeholders across multiple functions to resolve challenging customer situations. Prioritize and manage a high volume of escalations independently while maintaining high service standards. Identify opportunities to improve support processes, knowledge sharing, and overall customer experience initiatives. Apply sound judgment when evaluating exceptions to standard procedures and recommending appropriate solutions. Contribute to team development through mentorship, collaboration, and participation in continuous improvement efforts. Requirements United States citizenship and possession of a valid U.S. passport. 5–7 years of experience in customer engagement, support operations, customer success, or a related field. 5–7 years of experience managing escalations and working with support ticketing systems. Minimum of 3 years of experience supporting enterprise software, cloud-based platforms, productivity suites, or business applications. Proven ability to manage high-priority customer issues and coordinate resolutions across multiple stakeholders. Excellent written and verbal communication skills, including the ability to explain technical concepts to non-technical audiences. Strong stakeholder management, collaboration, and relationship-building capabilities. Demonstrated ability to work effectively in fast-paced environments while managing competing priorities. Strong analytical and problem-solving skills, with the ability to navigate ambiguity and make informed decisions. Customer-focused mindset with a commitment to delivering exceptional service and advocacy. Experience working with cloud technologies, enterprise applications, licensing-related support, or partner ecosystems is highly desirable. Strong organizational skills, self-motivation, and the ability to work independently. Fluency in English required. Benefits Competitive hourly compensation ranging from $30–$33 USD per hour (based on experience, qualifications, and location). Fully remote work opportunity within the United States. Comprehensive medical, dental, and vision insurance coverage. Flexible Spending Account (FSA). 401(k) retirement savings plan. Competitive paid time off package. Parental leave benefits. Professional development and career growth opportunities. Exposure to cutting-edge enterprise and cloud technologies. Collaborative and supportive work environment focused on learning and innovation. ## Additional Information How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether? Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time. #LI-CL1", "summaryDescription" : "Support Engineer - Escalation Management. Skills: Escalation management, Customer support. Manage customer escalations. Drive customer escalation resolution", "postedDate" : "2026-06-15T03:55:44.340", "createdAt" : "2026-06-15T03:55:44.340", "lastUpdated" : "2026-06-16T12:19:22.017", "ingestTimestamp" : "2026-06-16T03:22:02.898", "mongoId" : "6a30511af292fd229cefa781", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "50k-75k", "hasSalary" : false, "allSkills" : [ "Escalation management", "Customer support", "Support operations", "Customer success", "Enterprise software", "Cloud-based platforms", "Productivity suites", "Business applications", "Support ticketing systems" ], "skillCount" : 9, "jobCategory" : "sales", "jobSubcategory" : "customer_success", "seniorityLevel" : "Senior", "dataQualityScore" : 0.8888889, "_score" : 888.08984, "daysOld" : 1, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "68b706967fc9a711f0f6f106", "title" : "Senior Security Incident Response Engineer", "company" : "Amazon.com Services LLC", "industry" : "Systems, Quality, Security Engineering, Systems Security Engineering, amazon security", "salary" : { "min" : 143300.0, "max" : 247600.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Seattle, Washington, USA", "locations" : [ "Seattle, Washington, USA" ], "timestamp" : "2026-06-15T03:15:22.523", "fingerprint" : "557fc71c43f8425ad3ede7e1896c755a137ec1863b4d9868b798c7018c19161b", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/3054814/apply", "externalId" : "9b21d22c-d0c3-4bd6-9b1b-3f576fbb97c6", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Seattle", "state" : "Washington", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "47.6038321,-122.3300620" } ], "locationText" : "Seattle, Washington, United States", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 10, "experienceLevel" : "Senior", "technicalSkills" : "Operating system security, Network security, Cryptography, Software security, Malware analysis, Forensics, Security operations, Incident response, Security automation, Cloud computing, AWS", "professionalSkills" : [ "Security engineering", "Threat landscape", "Security automation tooling" ], "hardSkillsList" : [ "Incident response lifecycle", "Security monitoring", "Programmatic automation", "Security issue prevention" ], "softSkillsList" : [ "Creative problem solving", "Critical thinking" ], "hardSkills" : [ { "name" : "Incident response lifecycle", "level" : "intermediate" }, { "name" : "Security monitoring", "level" : "intermediate" }, { "name" : "Programmatic automation", "level" : "intermediate" }, { "name" : "Security issue prevention", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Creative problem solving" }, { "name" : "Critical thinking" } ], "majorSkills" : "Incident response, Security automation, Cloud security", "majorSkillsList" : [ "Incident response", "Security automation", "Cloud security" ], "coreResponsibilities" : "Lead response to security issues, Conduct security monitoring, Conduct response activities, Design and build tooling, Enable programmatic automation, Lead security engineer, Provide security guidance, Provide technical guidance, Influence process and priorities, Improve security outcomes, Provide strategic guidance, Bar raise security issues, Escalate security issues, Identify prevention opportunities, Mentor junior engineers, Develop junior engineers", "teamCollaboration" : "Global team environment; Multiple security teams; Cross-functional teams", "domainKnowledge" : "Operating system security; Network security; Cryptography; Software security; Malware analysis; Forensics; Security operations; Incident response; Security intelligence; Cloud provider security", "domainList" : [ "operating-system-security", "network-security", "cryptography", "software-security", "malware-analysis", "forensics", "security-operations", "incident-response", "security-intelligence", "cloud-provider-security" ], "domainSpecificKnowledge" : [ "Operating system security", "Network security", "Cryptography", "Software security", "Malware analysis", "Forensics", "Security operations", "Incident response", "Security intelligence", "Cloud provider security" ], "toolProficiency" : [ "SOAR platforms", "SIEM platforms" ], "communicationSkills" : "Oral communication; Written communication", "continuousLearning" : "Learning about security domains", "innovationCreativity" : "Creative problem solving", "problemSolvingSkills" : "Creative problem solving; Critical problem solving", "outcomesObjectives" : "Improve security outcomes", "qualificationsBasic" : "BS degree in Computer Science or equivalent, 7+ years systems/network/application security, 5+ years on Security team, 1 year programming/scripting language, Experience leading junior engineers", "qualificationsPreferred" : "Excellent written/verbal communication, 7+ years security response/automation/threat intelligence, Malware analysis experience, Forensics experience, SOAR platforms experience, SIEM platforms experience, Experience with MS Windows, Linux, MacOS, Experience with Amazon Web Services", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "The Amazon Web Services team is looking for a passionate Senior Security Incident Response Engineer who can lead the response to security issues across the largest cloud provider in the world. You must thrive in dynamic/ambiguous situations, and think like both an attacker and defender, while working through the entire incident response lifecycle. You’ll be working in a global team environment where clear and accurate communication and collaboration on security issues is critical. In this role you’ll be conducting security monitoring and response activities for the Amazon internal network. We value broad and deep technical knowledge, specifically in the fields of operating system security, network security, cryptography, software security, malware analysis, forensics, security operations, incident response, and emergent security intelligence. We don’t expect you to be an expert in all of the domains mentioned above, but we do expect you to be excited to learn about them! You’ll apply your creative and critical problem solving skills to quickly design and build tooling that enables programmatic automation at a massive scale. You must have a passion for engineering solutions to complex security challenges, and recognize and fill gaps in capabilities. Above all, you should be passionate about information security, the threat landscape and security automation and tooling. Key job responsibilities - Work across multiple security teams as a lead security engineer providing security and technical guidance. - Influence your team’s and partners’ process, priorities, and choices by using data to improve security outcomes - Provide technical and strategic guidance to senior leaders and stakeholders through effective oral and written communications - Bar raise security issues and escalate appropriately - Identify opportunities to prevent security issues at scale - Mentor and develop teammates both technically and professionally About the team Diverse Experiences Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why Amazon Security? At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores. Inclusive Team Culture In Amazon Security, it’s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices. Training & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve. Basic Qualifications: - BS degree in Computer Science, Computer Engineering, Electrical Engineering or equivalent related field. - 7+ years of demonstrated experience with a focus in areas such as systems, network, and/or application security. - 5+ years experience on a Security team, especially experience coordinating responses to security incidents. - 1 year proficiency with one high-level programming or scripting language. - Experience leading and coaching junior security engineers to improve their skills and effectiveness Preferred Qualifications: - Excellent written and verbal communication skills with the ability to adapt messaging to executive, technical, and non-technical audiences. - 7+ years experience working in security response, security automation tooling, or threat intelligence. - Experience with malware analysis, forensics, SOAR, SIEM platforms, and a variety of Operating Systems (MS Windows, Linux, MacOS) - Experience with Amazon Web Services. Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner. Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $143,300/year in our lowest geographic market up to $247,600/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit https://www.aboutamazon.com/workplace/employee-benefits . This position will remain posted until filled. Applicants should apply via our internal or external career site.", "summaryDescription" : "Senior Security Incident Response Engineer at Amazon.com Services LLC. Skills: Incident response, Security automation, Cloud security. Lead response to security issues. Conduct security monitoring", "postedDate" : "2026-06-13T10:52:46.897", "createdAt" : "2026-06-13T10:52:46.897", "lastUpdated" : "2026-06-15T03:15:22.523", "ingestTimestamp" : "2026-06-13T10:52:46.897", "mongoId" : "68b706967fc9a711f0f6f106", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/3054814/apply", "salaryAnnualMin" : 143300, "salaryAnnualMax" : 247600, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Incident response lifecycle", "Security monitoring", "Programmatic automation", "Security issue prevention", "Creative problem solving", "Critical thinking", "Incident response", "Security automation", "Cloud security", "Security engineering", "Threat landscape", "Security automation tooling", "Operating system security", "Network security", "Cryptography", "Software security", "Malware analysis", "Forensics", "Security operations", "Security intelligence", "Cloud provider security", "SOAR platforms", "SIEM platforms" ], "skillCount" : 23, "jobCategory" : "engineering", "dataQualityScore" : 1.0, "_score" : 887.6233, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Cloud Computing" }, { "id" : "6a2c5f4074d8ee00a08ea55f", "title" : "Security Incident Response Lead", "company" : "Nscale", "industry" : "AI Infrastructure", "salary" : { "min" : 150000.0, "max" : 225000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "AMER", "locations" : [ "AMER" ], "timestamp" : "2026-06-15T02:45:24.541", "fingerprint" : "97da22b2e3f980604e8d6395c438f3f52604ff35672fecd27a2405a86ad0765f", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://job-boards.eu.greenhouse.io/nscaleoperationsukltd/jobs/4824321101", "externalId" : "4824321101", "industryFunction" : { }, "structuredLocations" : [ { "country" : "United States", "continent" : "na", "workMode" : "remote" }, { "country" : "Canada", "continent" : "na", "workMode" : "remote" } ], "locationText" : "United States; Canada", "experienceMinYears" : 8, "experienceMaxYears" : 15, "experienceLevel" : "Lead", "technicalSkills" : "Cloud infrastructure, SIEM, EDR/XDR, Automation", "professionalSkills" : [ "Incident leadership", "Incident coordination", "Technical leadership", "Root cause analysis", "Threat hunting", "Detection engineering" ], "hardSkillsList" : [ "Digital forensics", "Incident response", "Security operations", "Forensics techniques", "Investigation techniques", "Threat intelligence", "Incident lifecycles" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Digital forensics", "level" : "intermediate" }, { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Security operations", "level" : "intermediate" }, { "name" : "Forensics techniques", "level" : "intermediate" }, { "name" : "Investigation techniques", "level" : "intermediate" }, { "name" : "Threat intelligence", "level" : "intermediate" }, { "name" : "Incident lifecycles", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident response, Digital forensics, Cloud security", "majorSkillsList" : [ "Incident response", "Digital forensics", "Cloud security" ], "coreResponsibilities" : "Lead end-to-end security incident response, Act as incident commander, Coordinate cross-functional response efforts, Conduct investigations, Oversee investigations, Apply digital forensics techniques, Drive containment efforts, Drive eradication efforts, Drive recovery efforts, Contribute to threat hunting, Contribute to proactive investigations, Develop incident response playbooks, Maintain incident response playbooks, Develop escalation frameworks, Establish escalation frameworks, Lead post-incident reviews, Lead root cause analysis, Drive long-term remediation actions, Partner to improve alerting, Partner to improve triage, Partner to improve response workflows, Build incident response tooling, Scale incident response tooling, Enhance case management systems", "teamCollaboration" : "Cross-functional response efforts; Partner with Detection & Response; Coordinate with Infrastructure; Coordinate with IT; Coordinate with Legal; Coordinate with Compliance", "domainKnowledge" : "AI infrastructure; High-performance computing; Large-scale distributed systems; Attack techniques; Threat actors; Incident lifecycles; Cloud environments; Production environments", "domainList" : [ "ai-infrastructure", "high-performance-computing", "large-scale-distributed-systems", "attack-techniques", "threat-actors", "incident-lifecycles", "cloud-environments", "production-environments" ], "domainSpecificKnowledge" : [ "AI infrastructure", "High-performance computing", "Large-scale distributed systems", "Attack techniques", "Threat actors", "Incident lifecycles", "Cloud environments", "Production environments" ], "toolProficiency" : [ "SIEM", "EDR/XDR", "Detection tooling", "Case management systems" ], "communicationSkills" : "Brief leadership; Coordinate across teams", "problemSolvingSkills" : "Root cause analysis; Troubleshooting", "outcomesObjectives" : "End-to-end IR effectiveness; High-severity incident coordination; Post-incident review completion; Remediation completion; IR tooling maturity; Automation maturity; Workflow maturity", "qualificationsBasic" : "8-12+ years incident response experience, 8-12+ years security operations experience, 8-12+ years digital forensics experience, Proven experience leading high-severity investigations, Hands-on experience with SIEM, Hands-on experience with EDR/XDR, Hands-on experience with detection tooling, Operate as technical leader, Make decisions under pressure, Brief leadership, Coordinate across teams", "qualificationsPreferred" : "Experience in AI infrastructure, Experience in high-performance computing, Experience in large-scale distributed systems, Familiarity with detection engineering, Familiarity with threat hunting, Familiarity with building automation for IR", "remoteFriendly" : true, "rawDescription" : "About Nscale Nscale is the GPU cloud engineered for AI. We provide cost-effective, high-performance infrastructure for AI start-ups and large enterprise customers. Nscale enables AI-focused companies to achieve superior results by reducing the complexity of AI development. Our GPU cloud bolsters technical capabilities and directly supports strategic business outcomes, including cost management, rapid innovation, and environmental responsibility. We thrive on a culture of relentless innovation, ownership, and accountability, where every team member takes pride in their work and drives it with excellence and urgency. As an Nscaler, you’ll build trust through openness and transparency, where everyone is inspired to do their best work. If you join our team, you’ll be contributing to building the technology that powers the future. About the Role We’re hiring a Security Incident Response Lead to own and evolve Nscale’s incident response capability in a high-scale, AI-native environment. This is a hands-on leadership role focused on leading investigations across infrastructure, enterprise systems, and security events, while driving effective containment, eradication, and recovery. The role operates at the center of incident coordination and partners closely with Detection & Response as well as cross-functional stakeholders including Infrastructure, IT, Legal, and Compliance. You will help shape how Nscale detects and responds to threats by building the processes, tooling, and operational rigor behind the incident response function. This role is critical to strengthening the organization’s security posture and ensuring high-severity events are managed with speed, clarity, and technical depth. This role will be part of the global CISO organization. What you'll be doing Incident Leadership & Coordination Lead end-to-end security incident response across the organization Act as the incident commander for high-severity events Coordinate cross-functional response efforts with Infrastructure, IT, Legal, and Compliance Participate in and help design on-call and escalation rotations Investigations & Forensics Conduct and oversee investigations across endpoints, cloud, and infrastructure systems Apply digital forensics techniques across logs, endpoints, and cloud environments Drive containment, eradication, and recovery efforts for active security incidents Contribute to threat hunting and proactive investigations Process, Playbooks & Operational Rigor Develop and maintain incident response playbooks and runbooks Establish escalation frameworks to support effective incident handling Lead post-incident reviews and root cause analysis efforts Drive long-term remediation actions following incidents Tooling & Response Improvement Partner with Detection & Response teams to improve alerting, triage, and response workflows Build and scale incident response tooling and automation Enhance case management systems that support investigation and response operations KPIs End-to-end security incident response effectiveness High-severity incident coordination and command Post-incident review and remediation completion Incident response tooling, automation, and workflow maturity About You 8–12+ years of experience in incident response, security operations, or digital forensics Proven experience leading complex, high-severity incident investigations in cloud or distributed environments Strong expertise in forensics and investigation techniques across endpoints, cloud, and logs Hands-on experience with SIEM, EDR/XDR, and detection tooling Familiarity with cloud infrastructure and modern production environments Deep understanding of attack techniques, threat actors, and incident lifecycles Ability to operate as a technical leader during incidents and make decisions under pressure Strong communication skills with the ability to brief leadership and coordinate across teams Experience in AI infrastructure, high-performance computing, or large-scale distributed systems is a plus Familiarity with detection engineering, threat hunting, or building automation for incident response workflows is beneficial What we can offer you At Nscale, you'll find a collaborative, supportive, and innovative environment where your contributions spark real impact. We're building something extraordinary, and we want you at the core. Highly competitive US compensation package (base + bonus + equity), with performance reviews every 12 months. \uD83D\uDE80 Join one of the fastest-growing AI infrastructure companies — your chance to directly shape how global AI capacity is planned and deployed. ✨ Expect a dynamic progression plan tailored to your ambitions. Grow by leading critical cross-functional initiatives and shaping capital strategy — always with our full support. Human-First Flexibility: We treat you as humans first. \uD83E\uDEF6\uD83C\uDFFD Our flexible workplace trusts Nscalers to deliver, giving you the autonomy to shape your day around life's moments. Equal Opportunities Statement We strongly encourage applications from people of colour, the LGBTQ+ community, people with disabilities, neurodivergent people, parents, carers, and people from lower socio-economic backgrounds. If there’s anything we can do to accommodate your specific situation, please let us know. The responsibilities outlined in this job description are not exhaustive and are intended to provide a general overview of the position. The employee may be required to perform additional duties, tasks, and responsibilities as assigned by management, consistent with the skills and qualifications required for the role. For information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here. Salary Range The range below reflects the base salary for the position. Actual compensation may vary based on job-related factors such as skill set, experience, education, and location. In addition to base salary, this role may be eligible for bonus, equity, and/or commission programs. Nscale may offer a competitive benefits package including medical, dental, vision, flexible paid time off, parental leave, and retirement plan participation. The range below reflects the base salary for the position. Actual compensation may vary based on job-related factors such as skill set, experience, education, and location. In addition to base salary, this role may be eligible for bonus, equity, and/or commission programs. Nscale may offer a competitive benefits package including medical, dental, vision, flexible paid time off, parental leave, and retirement plan participation. Salary Range $150,000—$225,000 USD For information on how Nscale handles candidate personal data, please see our Employee & Candidate Privacy Notice: Here.", "summaryDescription" : "Security Incident Response Lead at Nscale. Skills: Incident response, Digital forensics, Cloud security. Lead end-to-end security incident response. Act as incident commander", "postedDate" : "2026-06-12T22:26:36.876", "createdAt" : "2026-06-12T22:26:36.876", "lastUpdated" : "2026-06-15T02:45:24.541", "ingestTimestamp" : "2026-06-12T22:26:36.876", "mongoId" : "6a2c5f4074d8ee00a08ea55f", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 150000, "salaryAnnualMax" : 225000, "salaryBand" : "150k-200k", "hasSalary" : true, "allSkills" : [ "Digital forensics", "Incident response", "Security operations", "Forensics techniques", "Investigation techniques", "Threat intelligence", "Incident lifecycles", "Leadership", "Cloud security", "Incident leadership", "Incident coordination", "Technical leadership", "Root cause analysis", "Threat hunting", "Detection engineering", "AI infrastructure", "High-performance computing", "Large-scale distributed systems", "Attack techniques", "Threat actors", "Cloud environments", "Production environments", "SIEM", "EDR/XDR", "Detection tooling", "Case management systems" ], "skillCount" : 26, "jobCategory" : "other", "jobSubcategory" : "security", "dataQualityScore" : 0.8888889, "_score" : 882.61835, "daysOld" : 2, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "AI Infrastructure" }, { "id" : "6a2a42b574d8ee00a05cc47b", "title" : "Manager, IT Incident & Problem Management", "company" : "Engage And Reward", "industry" : "Financial Services", "salary" : { "min" : 111800.0, "max" : 111800.0, "currency" : "USD", "frequency" : "yearly" }, "location" : "CAN, Ontario, Oakville", "locations" : [ "CAN, Ontario, Oakville", "Canada" ], "timestamp" : "2026-06-12T06:15:48.754", "fingerprint" : "63d793a3d902debe58978602590026d4e9a5c13881b724afe91c0bee4c851f26", "source" : "workday", "language" : "en", "applyUrl" : "https://firstam.wd1.myworkdayjobs.com/fctcareers/job/CAN-Ontario-Oakville/Manager--IT-Incident---Problem-Management_R057019", "externalId" : "R057019", "industryFunction" : { }, "locationPoint" : "41.41677,2.16242", "structuredLocations" : [ { "city" : "Oakville", "state" : "Ontario", "country" : "Canada", "continent" : "na", "source" : "llm", "workMode" : "hybrid", "geo" : "43.4474360,-79.6666720" } ], "locationText" : "Oakville, Ontario, Canada", "employmentType" : "FULL_TIME", "experienceLevel" : "Manager", "technicalSkills" : "ITIL, ServiceNow, ITSM platforms, Infrastructure ecosystems, Cloud ecosystems, Application ecosystems, Monitoring tools, Observability tools", "professionalSkills" : [ "Managerial leadership", "Operational leadership", "Problem management", "Root cause analysis", "Service stability", "Continuous improvement", "Governance", "Reporting", "Stakeholder engagement", "Process optimization", "Risk management", "Compliance frameworks" ], "hardSkillsList" : [ "Incident management", "Problem management", "Change management", "Major incident management", "5 Whys", "Ishikawa", "Stakeholder management", "Executive communication", "Operational risk", "Compliance" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Incident management", "level" : "intermediate" }, { "name" : "Problem management", "level" : "intermediate" }, { "name" : "Change management", "level" : "intermediate" }, { "name" : "Major incident management", "level" : "intermediate" }, { "name" : "5 Whys", "level" : "intermediate" }, { "name" : "Ishikawa", "level" : "intermediate" }, { "name" : "Stakeholder management", "level" : "intermediate" }, { "name" : "Executive communication", "level" : "intermediate" }, { "name" : "Operational risk", "level" : "intermediate" }, { "name" : "Compliance", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident Management, Problem Management, Major Incident Management, Root Cause Analysis", "majorSkillsList" : [ "Incident Management", "Problem Management", "Major Incident Management", "Root Cause Analysis" ], "coreResponsibilities" : "Lead enterprise-wide incident response, Lead problem management functions, Ensure rapid restoration of service, Eliminate recurring issues, Lead Major Incident Management (MIM) process, Ensure rapid triage, escalation, and resolution, Act as Incident Commander, Drive coordination across technical teams, Establish clear incident ownership, Establish escalation models, Establish accountability frameworks, Drive formal Problem Management practices, Ensure root cause analysis (RCA), Track known errors, Implement permanent remediation plans, Ensure actionable follow-ups, Reduce repeat incidents, Analyze incident and problem data trends, Identify systemic risks, Identify improvement opportunities, Define stability initiatives, Implement stability initiatives, Partner with Change Management, Reduce change-related incidents, Establish and enforce incident SLAs, Establish and enforce problem SLAs, Establish and enforce OLAs, Establish and enforce KPIs, Provide executive reporting, Lead post-incident reviews, Ensure audit-ready documentation, Act as primary liaison, Ensure timely communications, Ensure clear communications, Ensure business-aligned communications, Support executive briefings, Support CIO-level briefings, Leverage ServiceNow to drive automation, Leverage ServiceNow for reporting, Leverage ServiceNow for governance, Enhance incident correlation, Enhance monitoring integration, Enhance alerting processes, Continuously improve operational processes", "teamCollaboration" : "Cross-functional teams; Infrastructure teams; Applications teams; Security teams; Business stakeholders; Senior leadership", "projectManagementSkills" : [ "ITIL practices" ], "domainKnowledge" : "ITIL; Regulated environments; Operational risk; Compliance frameworks; PCI; OSFI-aligned controls", "domainList" : [ "itil", "regulated-environments", "operational-risk", "compliance-frameworks", "pci", "osfi-aligned-controls" ], "domainSpecificKnowledge" : [ "ITIL", "Regulated environments", "Operational risk", "Compliance frameworks", "PCI", "OSFI-aligned controls" ], "toolProficiency" : [ "ServiceNow", "ITSM platforms" ], "communicationSkills" : "Executive reporting; Stakeholder communication; Business-aligned communication", "documentationSkills" : "Audit-ready documentation", "problemSolvingSkills" : "Root cause analysis; Trend analysis; Systemic improvements", "outcomesObjectives" : "Rapid restoration of service; Elimination of recurring issues; Reduce repeat incidents; Reduce change-related incidents", "qualificationsBasic" : "Bachelor's degree in Information Technology or equivalent experience, 8–12 years of IT experience, 5+ years in Incident and/or Problem Management leadership roles, Experience in regulated environments (financial services preferred)", "qualificationsPreferred" : "Financial services experience", "remoteFriendly" : true, "workSiteFlexibility" : "Hybrid", "rawDescription" : "# _**Company Summary**_ Come work for a company that’s committed to the success of each and every employee. A place where innovators and collaborators come together and build on each other’s talents. Where diversity is welcomed and celebrated. FCT provides industry-leading title insurance, default solutions and other real estate related products and services to legal, lending, valuation and real estate professionals across Canada. With FCT, you will have the opportunity to build a meaningful career. Join us as we continue to do exciting work and make a big impact on our colleagues, customers and communities. # # _**Job Summary**_ We are continually searching for great talent; individuals who possess a deep commitment to the customers and markets we serve. If you would like to join a company that is committed to the success of each employee and offers challenge, purpose and the opportunity to grow both personally and professionally in a team-oriented environment, you'll enjoy a career with us! We understand that fostering a diverse and inclusive environment is critical for the success of our business, and we actively work towards it every day. As Manager, IT Incident & Problem Management, you will lead the enterprise-wide incident response and problem management functions, ensuring rapid restoration of service and elimination of recurring issues impacting business operations. This role is accountable for operational stability, major incident governance, root cause analysis, and continuous service improvement. You will work cross-functionally with Infrastructure, Applications, Security, and Business stakeholders to ensure consistent execution of ITIL practices and alignment with FCT’s reliability and customer experience objectives. You will also establish accountability across IT for incident ownership, drive a structured problem management discipline, and provide transparent reporting to senior leadership on operational health, trends, and risks. **HERE’S HOW YOU’LL CONTRIBUTE:** **Operational Leadership** * Lead the end-to-end Major Incident Management (MIM) process, ensuring rapid triage, escalation, and resolution of P1/P2 incidents * Act as Incident Commander for high-severity events, driving coordination across technical teams and executive stakeholders * Establish clear incident ownership, escalation models, and accountability frameworks **Problem Management & Root Cause Discipline** * Drive formal Problem Management practices, including root cause analysis (RCA), known error tracking, and permanent remediation plans * Ensure all major incidents result in actionable and measurable follow-ups * Reduce repeat incidents through trend analysis and systemic improvements **Service Stability & Continuous Improvement** * Analyze incident and problem data trends to identify systemic risks and improvement opportunities * Define and implement stability initiatives aligned to operational KPIs (availability, MTTR, recurrence rates) * Partner with Change Management to reduce change-related incidents **Governance & Reporting** * Establish and enforce incident and problem SLAs, OLAs, and KPIs * Provide regular executive reporting on operational health, major incidents, and risk exposure * Lead post-incident reviews and ensure audit-ready documentation **Stakeholder Engagement** * Act as the primary liaison between IT and business stakeholders during incidents * Ensure timely, clear, and business-aligned communications during outages * Support executive and CIO-level briefings on operational risks and service stability **Tooling & Process Optimization** * Leverage ServiceNow (or equivalent) to drive workflow automation, reporting, and governance * Enhance incident correlation, monitoring integration, and alerting processes * Continuously improving operational processes aligned to ITIL best practices **HERE’S WHAT YOU’LL BRING:** * Highly skilled in managerial leadership skills to provide clarity on the organization vision and direction for the team. Demonstrated ability to set appropriate goals, including setting an effective framework of policies and procedures for the group, and the ability to build and sustain a team of direct reports who can deliver the performance required for the growth of FCT’s market share in all lines of business. * Experience with ITIL 4, SDI Global Best Practice Standard, and other relevant frameworks. * Bachelor’s degree in Information Technology or equivalent experience * 8–12 years of IT experience, with 5+ years in Incident and/or Problem Management leadership roles * Strong expertise in: * ITIL Incident, Problem, and Change Management processes * Major Incident Management (MIM) execution * Root cause analysis methodologies (e.g., 5 Whys, Ishikawa) * ServiceNow or similar ITSM platforms * Proven ability to operate in high-pressure, business-critical environments * Strong stakeholder management skills, including executive-level communication * Experience in regulated environments (financial services preferred) * Solid understanding of: * Infrastructure, cloud, and application ecosystems * Monitoring and observability tools * Operational risk and compliance frameworks (e.g., PCI, OSFI-aligned controls) Total Direct Compensation: $111,800 to $136,800 Any pay range is in $CAD. The stated pay range reflects the total expected compensation for this role (e.g., base pay plus any expected incentives or allowances, where applicable) **HERE’S WHAT SETS US APART:** Through mentoring, innovative tools, and a variety of programs that engage and reward, we empower each employee to be great and drive results. * Comprehensive benefits that include Employee and Family Assistance Program (EFAP) and Wellness Essentials * Group retirement savings plan with company match * Paid holidays and generous paid time off * Hybrid work arrangements * Paid volunteer opportunities and charitable donation matching * Employee recognition programs that include referral incentives * Potential for performance-based incentives * The opportunity to participate in our stock purchase plan * And more! *A _s per terms of the employment agreement_ For over a decade, FCT has been certified by the Great Place to Work® Institute as one of Canada’s best workplaces. We have also been recognized as a Top 50 Best Workplace in Canada, Best Workplaces in Canada for Women and Best Workplaces in Canada with Most Trusted Executive teams. In addition, FCT is recognized as one of Greater Toronto’s Top Employers. By joining us, you will not only be part of an award-winning organization, you will be part of a workforce that is engaged and empowered to succeed. Thank you for considering FCT. We look forward to meeting you. _In accordance with the Ontario Human Rights Code and the Accessibility for Ontarians with Disabilities Act, a request for accommodation will be accepted as part of FCT’s hiring process._ _To avoid any delays in the recruitment process, if you require accommodation to apply, please provide your accommodation needs in advance. You may also be required to submit adequate medical/other documentation to Human Resources to support your request for accommodation._ _FCT is an equal opportunity employer and is committed to an active nondiscrimination program. All recruitment, hiring, placements, transfers, promotions, training, compensation, benefits, discipline, and other terms and conditions of employment will be on the basis of the qualifications of the individual regardless of race, colour, place of origin, ethnic origin, citizenship, handicap (including mental and physical disability), sex, sexual orientation, gender identity and expression, creed (religion), marital status, family status (being in a parent/child relationship), age, or any other basis prohibited by the applicable provincial or federal human rights legislation._", "summaryDescription" : "Manager, IT Incident & Problem Management at Engage And Reward. Skills: Incident Management, Problem Management, Major Incident Management, Root Cause Analysis. Lead enterprise-wide incident response. Lead problem management functions", "postedDate" : "2026-06-10T12:22:01.676", "createdAt" : "2026-06-11T12:22:01.620", "lastUpdated" : "2026-06-12T06:15:48.754", "ingestTimestamp" : "2026-06-11T12:22:01.620", "mongoId" : "6a2a42b574d8ee00a05cc47b", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://firstam.wd1.myworkdayjobs.com/fctcareers/job/CAN-Ontario-Oakville/Manager--IT-Incident---Problem-Management_R057019", "salaryAnnualMin" : 111800, "salaryAnnualMax" : 111800, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Incident management", "Problem management", "Change management", "Major incident management", "5 Whys", "Ishikawa", "Stakeholder management", "Executive communication", "Operational risk", "Compliance", "Leadership", "Incident Management", "Problem Management", "Major Incident Management", "Root Cause Analysis", "Managerial leadership", "Operational leadership", "Root cause analysis", "Service stability", "Continuous improvement", "Governance", "Reporting", "Stakeholder engagement", "Process optimization", "Risk management", "Compliance frameworks", "ITIL practices", "ITIL", "Regulated environments", "PCI", "OSFI-aligned controls", "ServiceNow", "ITSM platforms" ], "skillCount" : 33, "jobCategory" : "engineering", "seniorityLevel" : "manager", "dataQualityScore" : 1.0, "_score" : 880.9428, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Financial Services" }, { "id" : "68c2e418f8b1b0376634c36a", "title" : "Security Engineer, Incident Response, CorpSec", "company" : "Amazon.com Services LLC", "industry" : "Systems, Quality, Security Engineering, Systems Security Engineering, amazon security", "salary" : { "min" : 125500.0, "max" : 212800.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Seattle, Washington, USA", "locations" : [ "Seattle, Washington, USA" ], "timestamp" : "2026-06-15T02:14:41.009", "fingerprint" : "1d73ed9116d8a3da3a8809fe15ae6abbeb90fed1911a7e130db33978905c1cf9", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/3079013/apply", "externalId" : "6e9703e8-c44e-4f5b-9f27-1aa702f0786e", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Seattle", "state" : "Washington", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "47.6038321,-122.3300620" } ], "locationText" : "Seattle, Washington, United States", "employmentType" : "FULL_TIME", "technicalSkills" : "Operating system security, Network security, Cryptography, Software security, Threat hunting, Detection engineering, Malware analysis, Forensics, Security operations, Incident response, Security intelligence, Programming language, Scripting language, Amazon Web Services", "professionalSkills" : [ "Security monitoring", "Response activities" ], "hardSkillsList" : [ "Incident response lifecycle", "Security monitoring", "Response activities", "Threat hunting", "Detection engineering", "Malware analysis", "Forensics", "Security operations", "Security intelligence" ], "softSkillsList" : [ "Leadership", "Curiosity", "Critical thinking" ], "hardSkills" : [ { "name" : "Incident response lifecycle", "level" : "intermediate" }, { "name" : "Security monitoring", "level" : "intermediate" }, { "name" : "Response activities", "level" : "intermediate" }, { "name" : "Threat hunting", "level" : "intermediate" }, { "name" : "Detection engineering", "level" : "intermediate" }, { "name" : "Malware analysis", "level" : "intermediate" }, { "name" : "Forensics", "level" : "intermediate" }, { "name" : "Security operations", "level" : "intermediate" }, { "name" : "Security intelligence", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" }, { "name" : "Curiosity" }, { "name" : "Critical thinking" } ], "majorSkills" : "Incident response, Security engineering, Threat intelligence", "majorSkillsList" : [ "Incident response", "Security engineering", "Threat intelligence" ], "coreResponsibilities" : "Lead response to security issues, Conduct security monitoring, Conduct response activities", "teamCollaboration" : "Global team environment; Security issues", "domainKnowledge" : "Operating system security; Network security; Cryptography; Software security; Threat hunting; Detection engineering; Malware analysis; Forensics; Security operations; Incident response; Security intelligence; Cloud provider", "domainList" : [ "operating-system-security", "network-security", "cryptography", "software-security", "threat-hunting", "detection-engineering", "malware-analysis", "forensics", "security-operations", "incident-response", "security-intelligence", "cloud-provider" ], "domainSpecificKnowledge" : [ "Operating system security", "Network security", "Cryptography", "Software security", "Threat hunting", "Detection engineering", "Malware analysis", "Forensics", "Security operations", "Incident response", "Security intelligence", "Cloud provider" ], "toolProficiency" : [ "SOAR", "SIEM platforms" ], "communicationSkills" : "Clear communication; Accurate communication", "continuousLearning" : "Learn about security domains", "problemSolvingSkills" : "Think like attacker; Think like defender", "qualificationsBasic" : "BS degree in Computer Science or equivalent, 3 years systems, network, or application security experience, 3 years experience on Security team, Coordinating security incident responses, Proficiency with one high-level programming or scripting language", "qualificationsPreferred" : "Experience in security operations or incident response, Experience in security automation tooling, Experience in threat intelligence, Familiarity with threat hunting, Familiarity with detection engineering, Familiarity with malware analysis, Familiarity with forensics, Familiarity with SOAR, Familiarity with SIEM platforms, Familiarity with variety of Operating Systems, Experience with Amazon Web Services", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "AWS is looking for a passionate Security Engineer, Incident Response who can lead the response to security issues across the largest cloud provider in the world. You must thrive in high-pressure situations, and think like both an attacker and defender, while working through the entire incident response lifecycle. You’ll be working in a global team environment where clear and accurate communication and collaboration on security issues is critical. In this role you’ll be conducting security monitoring and response activities for the Amazon internal network. We value broad and deep technical knowledge, specifically in the fields of operating system security, network security, cryptography, software security, threat hunting, detection engineering, malware analysis, forensics, security operations, incident response, and emergent security intelligence. We don’t expect you to be an expert in all of the domains mentioned above, but we do expect you to be excited to learn about them! About the team Diverse Experiences Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why Amazon Security? At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores. Inclusive Team Culture In Amazon Security, it’s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices. Training & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve. Basic Qualifications: - BS degree in Computer Science, Computer Engineering, Electrical Engineering or equivalent related field. Or equivalent industry certification. - 3 years of demonstrated experience with a focus in areas such as systems, network, and/or application security. - 3 years experience on a Security team, especially experience coordinating responses to security incidents. Proficiency with one high-level programming or scripting language. Preferred Qualifications: - Experience working in security operations or incident response, security automation tooling, or threat intelligence. - Familiarity with threat hunting, detection engineering, malware analysis, forensics, SOAR, SIEM platforms, and a variety of Operating Systems (MS Windows, Linux, MacOS). - Experience with Amazon Web Services. Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner. Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $125,500/year in our lowest geographic market up to $212,800/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit https://www.aboutamazon.com/workplace/employee-benefits . This position will remain posted until filled. Applicants should apply via our internal or external career site.", "summaryDescription" : "Security Engineer, Incident Response, CorpSec at Amazon.com Services LLC. Skills: Incident response, Security engineering, Threat intelligence. Lead response to security issues. Conduct security monitoring", "postedDate" : "2026-06-13T11:16:05.380", "createdAt" : "2026-06-13T11:16:05.380", "lastUpdated" : "2026-06-15T02:14:41.009", "ingestTimestamp" : "2026-06-13T11:16:05.380", "mongoId" : "68c2e418f8b1b0376634c36a", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/3079013/apply", "salaryAnnualMin" : 125500, "salaryAnnualMax" : 212800, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Incident response lifecycle", "Security monitoring", "Response activities", "Threat hunting", "Detection engineering", "Malware analysis", "Forensics", "Security operations", "Security intelligence", "Leadership", "Curiosity", "Critical thinking", "Incident response", "Security engineering", "Threat intelligence", "Operating system security", "Network security", "Cryptography", "Software security", "Cloud provider", "SOAR", "SIEM platforms" ], "skillCount" : 22, "jobCategory" : "engineering", "dataQualityScore" : 0.8888889, "_score" : 874.613, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Cloud Computing" }, { "id" : "69d3e6b92beec4dd3d3f7411", "title" : "Escalation Specialist", "company" : "ADCI", "industry" : "Investigation Loss Prevention, Real Estate/Facilities, Logistics", "salary" : { "min" : 750000.0, "max" : 1250000.0, "currency" : "INR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for an Escalation Specialist in Bengaluru, India, adjusted for mid-seniority and the logistics industry." }, "location" : "Bengaluru, Karnataka, IND", "locations" : [ "Bengaluru, Karnataka, IND" ], "timestamp" : "2026-06-15T04:26:39.703", "fingerprint" : "0e4b58eeb5a486e470ea0ca35f58d111b5b774b381ead0c2e5cf472324843155", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/10383886/apply", "externalId" : "2c98eaf1-c1ce-4cd2-be20-085cdbd3796e", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Bengaluru", "state" : "Karnataka", "country" : "India", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "12.9767936,77.5900820" } ], "locationText" : "Bengaluru, Karnataka, India", "employmentType" : "FULL_TIME", "technicalSkills" : "MS Office, Word, Excel, PowerPoint", "professionalSkills" : [ "Crisis management", "Incident triage", "Workplace violence triage" ], "hardSkillsList" : [ "Alarm monitoring", "Incident triage", "Crisis management", "Written reports" ], "softSkillsList" : [ "Ownership", "Customer obsession", "Composure", "Empathy" ], "hardSkills" : [ { "name" : "Alarm monitoring", "level" : "intermediate" }, { "name" : "Incident triage", "level" : "intermediate" }, { "name" : "Crisis management", "level" : "intermediate" }, { "name" : "Written reports", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Ownership" }, { "name" : "Customer obsession" }, { "name" : "Composure" }, { "name" : "Empathy" } ], "majorSkills" : "Security operations, Incident response, Customer support", "majorSkillsList" : [ "Security operations", "Incident response", "Customer support" ], "coreResponsibilities" : "Provide support to delivery associates, Research and troubleshoot with internal tools, Triage and prioritize incoming incidents, Collaborate with crisis management leadership, Transfer lower severity calls, Manage phone communications, Facilitate information flow, Write clear and concise reports", "teamCollaboration" : "Cross-functional coordination; Internal and external customers", "domainKnowledge" : "Global Security Operations; Operational risks; Security risks", "domainList" : [ "global-security-operations", "operational-risks", "security-risks" ], "domainSpecificKnowledge" : [ "Global Security Operations", "Operational risks", "Security risks" ], "communicationSkills" : "Oral skills; Writing skills", "documentationSkills" : "Written responses", "problemSolvingSkills" : "Troubleshooting", "specialRequirements" : "Shift work required, Nights, weekends, holidays, Support any schedule, 24x7 -365 Days operation", "qualificationsBasic" : "Speak, write, and read fluently in Spanish, Experience in computer skills, Proficiency in MS Office, Knowledge of working over internet, Experience navigating websites, Experience in written and spoken English, Ability to compose grammatically correct written responses, Work a flexible schedule/shift/work area, Read, write and speak Telugu, Hindi and English", "qualificationsPreferred" : "6+ months of customer service experience, Answering multiple phone lines, Ticket related communication, Command Center work environment, Intermediate fluency in Spanish, Intermediate fluency in Telugu/Hindi, Intermediate fluency in English, Bachelor’s degree, Experience in resolving conflicts, Experience providing crisis management triage, Experience setting appropriate expectations, Experience working in fast paced environments, Managing workload during stress", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "The mission of Amazon Global Security Operations Centre (GSOC) is to mitigate security and operational risks to our associates, physical assets, and brand. GSOC supports Amazon Worldwide Stores by providing 24/7 services including alarm monitoring and response, incident triage, and crisis management. Amazon is hiring an Escalation Specialist at GSOC- India office. The Escalation Specialist will work directly with customers, law enforcement, delivery associates, and operations to navigate and triage security and operational risks, while providing critical incident and workplace violence triage, coordination, and facilitation. Key job responsibilities • Provide support to delivery associates on-road, and customers receiving shipments or services from Amazon, by researching and troubleshooting with internal tools. • Triage and prioritize incoming incidents and collaborate with crisis management leadership. • Transfer lower severity calls, which can be a significant percentage of total call volume, to appropriate partner including Customer Service and Shipping/Delivery • Manage phone communications and facilitate the flow of information between various internal and external customers (Delivery Associates/Delivery Service Providers/Operations Managers/Customer Service Associates/Amazon Customers). • Write clear and concise reports in a timely manner which in turn will be escalated to senior leadership and stakeholders. A day in the life judgment, and be gifted at learning new technology. Demonstrating ownership, customer obsession, and concise oral and writing skills are crucial requirements for this role. Shift work will be required, potentially to include nights, weekends and public holidays. Must be willing to support any schedule during our DAY, NIGHT, or MIXED hours shifts. We operate 24x7 -365 Days. Basic Qualifications: - Speak, write, and read fluently in Spanish - Experience in computer skills, including proficiency in MS Office (Word, Excel, PowerPoint) - Knowledge of working over internet and successfully navigating websites - Experience in written and spoken English and an ability to compose grammatically correct, concise and accurate written responses - Work a flexible schedule/shift/work area, including weekends, nights, and/or holidays - Can read, write and speak Telugu, Hindi and English - Demonstrates effective composure, empathy, and a positive, professional attitude Preferred Qualifications: - 6+ months of customer service experience, to include answering multiple phone lines and ticket related communication in a Command Center work environment - Intermediate fluency in one or more of the following languages Spanish, Telugu/Hindi and English - Bachelor’s degree – Preferably in Criminal Justice, Political Science, Crisis Management or Business Administration - Experience in resolving conflicts, providing crisis management triage, and setting appropriate expectations with customers - Experience working in fast paced environments, and managing workload even during times of stress, or escalated activity Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Escalation Specialist at ADCI. Skills: Security operations, Incident response, Customer support. Provide support to delivery associates. Research and troubleshoot with internal tools", "postedDate" : "2026-06-13T10:24:58.398", "createdAt" : "2026-06-13T10:24:58.398", "lastUpdated" : "2026-06-15T04:26:39.703", "ingestTimestamp" : "2026-06-13T10:24:58.398", "mongoId" : "69d3e6b92beec4dd3d3f7411", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/10383886/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Alarm monitoring", "Incident triage", "Crisis management", "Written reports", "Ownership", "Customer obsession", "Composure", "Empathy", "Security operations", "Incident response", "Customer support", "Workplace violence triage", "Global Security Operations", "Operational risks", "Security risks" ], "skillCount" : 15, "jobCategory" : "marketing", "dataQualityScore" : 0.8888889, "_score" : 857.3699, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true }, { "id" : "69cf3f052beec4dd3d9340a4", "title" : "AWS Security Operations/Incident Response Engineer", "company" : "Amazon Web Services, Inc.", "industry" : "Systems, Quality, Security Engineering, Systems Security Engineering, Cloud Computing", "salary" : { "min" : 159000.0, "max" : 202400.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Herndon, Virginia, USA", "locations" : [ "Herndon, Virginia, USA" ], "certifications" : [ "CCSP", "Certified Cloud Security Professional", "CEH", "Certified Ethical Hacker", "CFR", "CyberSec First Responder", "Cloud+", "CySA+", "CompTIA Cybersecurity Analyst", "GCED", "GIAC Certified Enterprise Defender", "GICSP", "Global Industrial Cyber Security Professional", "PenTest+", "AWS certification", "AWS Solutions Architect" ], "timestamp" : "2026-06-15T08:10:44.516", "fingerprint" : "e7b6067f8d5e1ee3cf111fd915ee7bae8c724b95799fbd946bdb1b7400dc7409", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/10382311/apply", "externalId" : "49079c29-efa4-48bb-96db-5c916f303463", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Herndon", "state" : "Virginia", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "38.9695316,-77.3859479" } ], "locationText" : "Herndon, Virginia, United States", "employmentType" : "FULL_TIME", "technicalSkills" : "Python, Java, C++, HTTP(S), DNS, TCP/IP, Cryptography, Network security, Software security, Malware analysis, Forensics, Security operations, Incident response, Security intelligence, AWS", "professionalSkills" : [ "Risk assessment", "Security engineering" ], "hardSkillsList" : [ "Log analysis", "Incident response", "Forensics", "System tooling development", "Risk assessment", "Cryptography", "Network security", "Software security", "Malware analysis", "Security operations", "Security intelligence" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Log analysis", "level" : "intermediate" }, { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Forensics", "level" : "intermediate" }, { "name" : "System tooling development", "level" : "intermediate" }, { "name" : "Risk assessment", "level" : "intermediate" }, { "name" : "Cryptography", "level" : "intermediate" }, { "name" : "Network security", "level" : "intermediate" }, { "name" : "Software security", "level" : "intermediate" }, { "name" : "Malware analysis", "level" : "intermediate" }, { "name" : "Security operations", "level" : "intermediate" }, { "name" : "Security intelligence", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident response, Security operations, Cloud security", "majorSkillsList" : [ "Incident response", "Security operations", "Cloud security" ], "coreResponsibilities" : "Respond to security incidents, Prevent future incidents, Design cohesive responses, Coordinate responses across teams, Build security utilities, Build security tools, Communicate effectively", "teamCollaboration" : "Multiple teams across organization; Fellow Security Engineers", "domainKnowledge" : "Cloud security; National security; Cryptography; Network security; Software security; Malware analysis; Forensics; Security operations; Incident response; Security intelligence; AWS services", "domainList" : [ "cloud-security", "national-security", "cryptography", "network-security", "software-security", "malware-analysis", "forensics", "security-operations", "incident-response", "security-intelligence", "aws-services" ], "domainSpecificKnowledge" : [ "Cloud security", "National security", "Cryptography", "Network security", "Software security", "Malware analysis", "Forensics", "Security operations", "Incident response", "Security intelligence", "AWS services" ], "toolProficiency" : [ "Splunk", "ELK" ], "communicationSkills" : "Communicate at multiple levels; Communicate to multiple audiences", "problemSolvingSkills" : "Think like attacker; Think like defender; Mitigate risks", "specialRequirements" : "US Citizen, TS/SCI with polygraph, On-call responsibilities", "qualificationsBasic" : "Bachelor's degree or CCSP or CEH or CFR or Cloud+ or CySA+ or GCED or GICSP or PenTest+, 2+ years scripting or programming or security code review, Knowledge of networking protocols, Current, active US Government Security Clearance of TS/SCI with Polygraph", "qualificationsPreferred" : "AWS certification, Cloud Technology Certification, Knowledge of web protocols, Knowledge of common attacks, Knowledge of Linux/Unix tools, Knowledge of Linux/Unix architecture, Deep understanding of AWS service catalog, Used AWS services in production, Experience with log analysis systems, Familiarity with Windows logging systems, Familiarity with Linux logging systems, Understanding of high-level cryptography principles", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Amazon Web Services (AWS) is the leading cloud provider, providing infrastructure, storage, networking, messaging, and many other services to customers all over the world. AWS runs a globally distributed environment, operating at massive levels of scale. Businesses, from start-ups to enterprises, run their operations and applications on AWS’s multi-tenant infrastructure. Governmental organizations are also looking to and depending on AWS for cloud solutions and services. The AWS Security Incident Response team is seeking a focused Security Engineer who can take on a leadership role in responding to security issues in support of our National Security program. This engineer will work as a part of a growing team of security engineers who are focused on protecting the AWS infrastructure that is used by our national security customers. Our security engineers perform many duties during an average day: log analysis, incident response, forensics, system/tooling development, and risk assessment, just to name a few. You must thrive in high-pressure situations, think like both an attacker and defender, and drive relevant teams to take the right actions in the right time frames to mitigate risks. They also need to balance technical risks against business needs and be able to articulate risks and mitigations to members of leadership at various levels. You should have a good mix of deep technical knowledge and a demonstrated background in information security. We value broad and deep technical knowledge, specifically in the fields of cryptography, network security, software security, malware analysis, forensics, security operations, incident response, and emergent security intelligence. This position requires that the candidate selected be a US Citizen and must currently possess and maintain an active TS/SCI security clearance with polygraph. Key job responsibilities - Confidently and intelligently respond to security incidents, and proactively consider how to prevent the same type of incidents from occurring in the future. - Design and coordinate cohesive responses to security events that involve multiple teams across the organization. - Build security utilities and tools for internal use that enable you and your fellow Security Engineers to operate at high speed and wide scale. - Ability to communicate effectively at multiple levels of sensitivity, and multiple audiences. - Recognize, adopt and instill the best practices in security engineering fields throughout the organization: development, cryptography, network security, security operations, incident response, security intelligence. - Fulfill regular on-call responsibilities. About the team Diverse Experiences Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why Amazon Security? At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores. Inclusive Team Culture In Amazon Security, it’s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices. Training & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve. Basic Qualifications: - Bachelor's degree, or CCSP (Certified Cloud Security Professional) or CEH (Certified Ethical Hacker) or CFR (CyberSec First Responder) or Cloud+ or CySA+ (CompTIA Cybersecurity Analyst) or GCED (GIAC Certified Enterprise Defender) or GICSP (Global Industrial Cyber Security Professional) or PenTest+ - 2+ years of scripting, programming, or security code review in a common language, such as Python, Java or C++ experience - Knowledge of networking protocols such as HTTP(S), DNS, and TCP/IP - Current, active US Government Security Clearance of TS/SCI with Polygraph Preferred Qualifications: - AWS certification, such as, AWS Solutions Architect, or a similar cloud certification, or Cloud Technology Certification - Knowledge of web protocols, common attacks, and Linux/Unix tools and architecture - Deep understanding of the AWS service catalog. Ideally, you have used AWS services in a production capacity. - Experience with log analysis systems, like Splunk or ELK. - Familiarity with Windows and Linux logging systems. - Understanding of high-level cryptography principles (PKI, encryption algorithms, etc) Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner. The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits . USA, VA, Herndon - 159,300.00 - 202,400.00 USD annually", "summaryDescription" : "AWS Security Operations/Incident Response Engineer at Amazon Web Services, Inc.. Skills: Incident response, Security operations, Cloud security. Respond to security incidents. Prevent future incidents", "postedDate" : "2026-06-13T14:00:19.237", "createdAt" : "2026-06-13T14:00:19.237", "lastUpdated" : "2026-06-15T08:10:44.516", "ingestTimestamp" : "2026-06-13T14:00:19.237", "mongoId" : "69cf3f052beec4dd3d9340a4", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/10382311/apply", "salaryAnnualMin" : 159000, "salaryAnnualMax" : 202400, "salaryBand" : "150k-200k", "hasSalary" : true, "allSkills" : [ "Log analysis", "Incident response", "Forensics", "System tooling development", "Risk assessment", "Cryptography", "Network security", "Software security", "Malware analysis", "Security operations", "Security intelligence", "Leadership", "Cloud security", "Security engineering", "National security", "AWS services", "CCSP", "Certified Cloud Security Professional", "CEH", "Certified Ethical Hacker", "CFR", "CyberSec First Responder", "Cloud+", "CySA+", "CompTIA Cybersecurity Analyst", "GCED", "GIAC Certified Enterprise Defender", "GICSP", "Global Industrial Cyber Security Professional", "PenTest+", "AWS certification", "AWS Solutions Architect", "Splunk", "ELK" ], "skillCount" : 34, "jobCategory" : "engineering", "dataQualityScore" : 0.8888889, "_score" : 845.13446, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Cloud Security" }, { "id" : "6a2c751574d8ee00a09360f7", "title" : "Security Engineer, Detection and Response", "company" : "Serval", "industry" : "Engineering", "salary" : { "min" : 200000.0, "max" : 325000.0, "currency" : "USD", "frequency" : "Yearly" }, "location" : "San Francisco", "locations" : [ "San Francisco" ], "timestamp" : "2026-06-16T03:29:01.550", "fingerprint" : "a9b58b622fae2a5e015d888ceb1430e0f4c7af9bae19294b10f2e0362b229c6e", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/serval/5250c679-d490-407e-bd2e-b8b160c62aac/application", "externalId" : "5250c679-d490-407e-bd2e-b8b160c62aac", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San Francisco", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "37.7879363,-122.4075201" } ], "locationText" : "San Francisco, California, United States", "employmentType" : "FULL_TIME", "experienceMinYears" : 8, "experienceMaxYears" : 15, "experienceLevel" : "Lead", "technicalSkills" : "SIEM, Data lakes, EDR, Cloud telemetry, Logging", "professionalSkills" : [ "Detection engineering", "Incident response", "Security operations", "Instrumentation", "Observability", "Threat intelligence", "Program management", "Process improvement", "People management" ], "hardSkillsList" : [ "Security monitoring", "Incident investigation", "Incident containment", "Incident remediation", "Threat detection", "Response planning", "On-call management", "Escalation paths", "Tabletop exercises", "Telemetry analysis", "Adversary tradecraft" ], "softSkillsList" : [ "Leadership", "Mentoring" ], "hardSkills" : [ { "name" : "Security monitoring", "level" : "intermediate" }, { "name" : "Incident investigation", "level" : "intermediate" }, { "name" : "Incident containment", "level" : "intermediate" }, { "name" : "Incident remediation", "level" : "intermediate" }, { "name" : "Threat detection", "level" : "intermediate" }, { "name" : "Response planning", "level" : "intermediate" }, { "name" : "On-call management", "level" : "intermediate" }, { "name" : "Escalation paths", "level" : "intermediate" }, { "name" : "Tabletop exercises", "level" : "intermediate" }, { "name" : "Telemetry analysis", "level" : "intermediate" }, { "name" : "Adversary tradecraft", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" }, { "name" : "Mentoring" } ], "majorSkills" : "Detection engineering, Incident response, Security operations, Team leadership", "majorSkillsList" : [ "Detection engineering", "Incident response", "Security operations", "Team leadership" ], "coreResponsibilities" : "Design detection and response operations, Implement detection and response operations, Operate detection and response operations, Monitor security events, Triage security events, Investigate security events, Contain security events, Remediate security events, Build a team, Lead a team, Mentor a team, Hire for functions, Scale functions, Ensure operational rigor, Ensure operational readiness, Improve detection quality, Improve detection coverage, Ensure critical telemetry is available, Ensure critical telemetry is reliable, Ensure critical telemetry is actionable, Embed detection and response by design, Build a security program, Use Serval's agents for security problems, Use Serval's agents for security-operations problems", "teamCollaboration" : "Partner with Engineering; Partner with Product; Partner with Infrastructure; Work with stakeholders", "domainKnowledge" : "Modern observability stacks; Modern adversary tradecraft; Cloud environments; Corporate environments; Production environments; AI-native automation", "domainList" : [ "modern-observability-stacks", "modern-adversary-tradecraft", "cloud-environments", "corporate-environments", "production-environments", "ai-native-automation" ], "domainSpecificKnowledge" : [ "Modern observability stacks", "Modern adversary tradecraft", "Cloud environments", "Corporate environments", "Production environments", "AI-native automation" ], "communicationSkills" : "Written communication; Verbal communication; Incident communication", "innovationCreativity" : "Solve frontier security problems; Solve frontier security-operations problems", "problemSolvingSkills" : "Root cause analysis", "outcomesObjectives" : "Scale detection and response operations; Improve response quality; Improve response speed", "qualificationsBasic" : "10+ years in cybersecurity, Deep expertise in detection engineering, Deep expertise in incident response, Deep expertise in security operations, Deep experience building detection and response teams, Deep experience building instrumentation/observability teams, Deep experience building threat intelligence teams, Stellar leadership skills, Demonstrated history of driving improvements, Exceptional written communication skills, Exceptional verbal communication skills, Remain calm under pressure, Effectively run command of security incidents, Deep expertise in modern observability stacks, Deep expertise in SIEM, Deep expertise in data lakes, Deep expertise in EDR, Deep expertise in cloud telemetry, Deep expertise in logging, Deep expertise in detection primitives, Understand modern adversary tradecraft (TTPs), Demonstrated experience translating TTPs into detection strategies, Demonstrated experience translating TTPs into response actions, Mission-oriented, Unimpeachable integrity, Passionate about detecting and responding to adversaries", "rawDescription" : "WHO WE ARE Serval http://serval.com is an AI-native automation platform transforming how enterprises operate. We build intelligent agents that understand real-world workflows and execute them end-to-end — replacing manual processes and rigid legacy systems with adaptive, learning software. Founded in early 2024, Serval is already trusted by companies like Fox, Notion, Perplexity, Vercel, and Brex to automate high-volume, high-friction operational work across their organizations. At the core of Serval is an agentic AI platform that turns natural language into production-grade workflows. Our agents don’t just respond to requests — they reason, take action across systems, and continuously improve with usage. What began with operational use cases has quickly evolved into a horizontal AI automation layer used across IT, HR, Finance, Security, Legal, and Engineering. Our mission is to eliminate repetitive, manual work across the enterprise and give teams leverage through intelligent automation. Long term, we’re building the universal AI operations layer — a system of agents that sits across business functions and runs the workflows that keep modern companies moving. We’re backed by leading investors including Sequoia Capital, Redpoint Ventures, Meritech, First Round, General Catalyst, Elad Gil, and others. ROLE OVERVIEW As Detection and Response Lead, you'll build and scale the foundations of Serval's cybersecurity detection and response operations. You will set the strategy and drive execution for security monitoring, incident response, recovery, and post-incident improvement across our infrastructure and the systems our customers trust us to operate in. You'll be a hands-on leader with deep technical credibility and strong operational instincts. You will build and mentor a team, partner closely with Engineering and Product, and ensure that detection and response capabilities are embedded by design into the systems that power Serval. WHAT YOU'LL DO - Design, implement, and operate detection and response operations, including continuous monitoring, triage, investigation, containment, and remediation of security events across a diverse set of networks and infrastructure. - Build, lead, and directly mentor a team spanning observability, detection and response, and threat intelligence, hiring and scaling these functions deliberately and proportionately as Serval's platform and customer footprint grow. - Ensure world-class operational rigor and readiness through incident playbooks, on-call and escalation paths, tabletop exercises, and continuous improvement of response quality and speed. - Improve detection quality and coverage by partnering with engineering teams to ensure critical telemetry is available, reliable, and actionable across cloud, corporate, and production environments. - Partner deeply across Engineering, Product, and Infrastructure to embed detection and response into Serval's systems by design rather than as an afterthought. - Build a security program capable of withstanding sophisticated adversaries, including by using Serval's own agents to solve frontier security and security-operations problems. WHAT YOU'LL NEED - Have 10+ years in cybersecurity with deep expertise in detection engineering, incident response, and security operations. - Have deep experience building and leading detection and response, instrumentation/observability, and threat intelligence teams. - Have stellar leadership skills and a demonstrated history of driving durable, continuous improvements to programs, processes, and people. - Have exceptional written and verbal communication skills, can remain calm under pressure, and can effectively run command of security incidents involving numerous stakeholders across a diverse gamut of teams, expertise, and seniority. - Have deep expertise in modern observability stacks (e.g., SIEM, data lakes, EDR, cloud telemetry, logging) and detection primitives. - Understand modern adversary tradecraft (TTPs) and have demonstrated experience translating it into practical detection strategies and response actions. - Are mission-oriented, have unimpeachable integrity, and are passionate about detecting and responding to adversaries in a highly complex, fast-paced environment. WHAT WE OFFER - Impact: Be a key player in shaping the success of our product and company. - Growth: Build a fundamentally new AI product offering with the support of our experienced team and investors. Grow rapidly with the company. - Culture: Join a culture that values innovation, ownership, accountability, and fun.", "summaryDescription" : "Security Engineer, Detection and Response at Serval. Skills: Detection engineering, Incident response, Security operations, Team leadership. Design detection and response operations. Implement detection and response operations", "createdAt" : "2026-06-14T19:27:55.217", "lastUpdated" : "2026-06-16T03:29:01.550", "ingestTimestamp" : "2026-06-14T19:27:55.217", "mongoId" : "6a2c751574d8ee00a09360f7", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 200000, "salaryAnnualMax" : 325000, "salaryBand" : "200k+", "hasSalary" : true, "allSkills" : [ "Security monitoring", "Incident investigation", "Incident containment", "Incident remediation", "Threat detection", "Response planning", "On-call management", "Escalation paths", "Tabletop exercises", "Telemetry analysis", "Adversary tradecraft", "Leadership", "Mentoring", "Detection engineering", "Incident response", "Security operations", "Team leadership", "Instrumentation", "Observability", "Threat intelligence", "Program management", "Process improvement", "People management", "Modern observability stacks", "Modern adversary tradecraft", "Cloud environments", "Corporate environments", "Production environments", "AI-native automation" ], "skillCount" : 29, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Director", "dataQualityScore" : 0.8888889, "_score" : 827.23773, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "68e6b1d770f0b99d58d669d3", "title" : "Associate Customer Incident Responder, AWS Customer Incident Response Team (CIRT)", "company" : "Amazon Web Services, Inc.", "industry" : "Systems, Quality, Security Engineering, Systems Security Engineering, Cloud Computing", "salary" : { "min" : 125500.0, "max" : 212800.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Arlington, Virginia, USA", "locations" : [ "Arlington, Virginia, USA" ], "timestamp" : "2026-06-15T03:07:34.087", "fingerprint" : "e41ba28c00f8a5fa7ff7a6b6f7e4b967a32c1d34e6140338d9bfa0a32bb978b0", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/3103444/apply", "externalId" : "3edaebce-b7da-4159-88b6-ebd603fd4b2d", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Arlington", "state" : "Virginia", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "38.8769326,-77.0893094" } ], "locationText" : "Arlington, Virginia, United States", "employmentType" : "FULL_TIME", "technicalSkills" : "Python, C, C++, Java, Ruby, PowerShell, AWS", "professionalSkills" : [ "Incident response", "Threat detection", "Security operations", "Cloud security" ], "hardSkillsList" : [ "Log collection", "Log analysis", "Root cause analysis", "Preventative guidance" ], "softSkillsList" : [ "Mentoring" ], "hardSkills" : [ { "name" : "Log collection", "level" : "intermediate" }, { "name" : "Log analysis", "level" : "intermediate" }, { "name" : "Root cause analysis", "level" : "intermediate" }, { "name" : "Preventative guidance", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Mentoring" } ], "majorSkills" : "Incident response, Threat detection, Security solutions", "majorSkillsList" : [ "Incident response", "Threat detection", "Security solutions" ], "coreResponsibilities" : "Support incident response operations, Become a technical resource, Contribute to build and deploy threat detection and, Collaborate to design, build, and deploy solutions to, Develop high-quality content, Innovate on behalf of customers, Mentor and invest in our team, partners and", "teamCollaboration" : "Part of a team; Collaborate with AWS service teams", "domainKnowledge" : "Cloud environments; Scalable computing architectures; Security incidents; Security operations; Shared security model", "domainList" : [ "cloud-environments", "scalable-computing-architectures", "security-incidents", "security-operations", "shared-security-model" ], "domainSpecificKnowledge" : [ "Cloud environments", "Scalable computing architectures", "Security incidents", "Security operations", "Shared security model" ], "communicationSkills" : "Communicate complex technical matters", "documentationSkills" : "Reference architectures; White papers; Blog posts", "innovationCreativity" : "Innovate with new technologies; Explore new challenges", "problemSolvingSkills" : "Root cause analysis", "specialRequirements" : "Periodic on-call required", "outcomesObjectives" : "Achieve more with AWS cloud; Respond to security incidents; Automate security operations; Deliver results", "qualificationsBasic" : "Experience with coding/scripting in one or more languages, Knowledge of networks, protocols, cloud and security fundamentals, 2+ years of hands-on technical experience in threat detection, log collection and analysis, incident response, and/or security operations", "qualificationsPreferred" : "Experience with core security functions, Hands-on technical experience in building scripts, tools, or methodologies, Experience with developing and training AI models, Communicate complex technical matters clearly and concisely orally and in writing, Ability to manage customers expectations during security events, and deliver results", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "AWS Global Services includes experts from across AWS who help our customers design, build, operate, and secure their cloud environments. Customers innovate with AWS Professional Services, upskill with AWS Training and Certification, optimize with AWS Support and Managed Services, and meet objectives with AWS Security Assurance Services. Our expertise and emerging technologies include AWS Partners, AWS Sovereign Cloud, AWS International Product, and the Generative AI Innovation Center. You’ll join a diverse team of technical experts in dozens of countries who help customers achieve more with the AWS cloud. Do you want to work on planetary scale incident response solutions in the cloud? Are you skilled at performing Incident Response activities and helping customers build threat detection and incident response capabilities using highly scalable computing architectures? Are you excited to help customers respond to security incidents and automate security operations giving them unprecedented capability and agility? Do you enjoy working on fast-paced complex projects focused on game changing business outcomes for customers globally? As a member of the Threat Detection and Incident Response Practice in the AWS Global Service Security you will have the opportunity to help customers respond to security incidents and pioneer technically superb security solutions to help customer operate securely in the cloud. Building on those experiences you’ll collaborate with AWS service teams on new features, innovate with new technologies, and explore new challenges. The Global Services Security team, a part of Amazon Web Services (AWS), leverages the expertise and ingenuity of our builders to establish scalable security solutions for both internal and external customers that drive business outcomes. Our goal of securing the world’s workloads and building a brighter future for humanity requires us to focus on reliable delivery of bar raising security outcomes and investment in security mechanisms and automation on behalf of our customers. The AWS Customer Incident Response Team (CIRT) is a specialized 24/7 global (AWS) team that provides support to customers in responding to active security events on their side of the shared security model. The team is made up of AWS Solutions Architects and Security Engineers who are experienced in incident response.to assist customers with identifying Indicators of Compromise, isolation, containment, log collection and analysis, determining root cause, recovery, and preventative guidance to avoid recurrence. Key job responsibilities • Support incident response operations • Become a technical resource that earns the trust of customer stakeholders before, during, and after a security event. • Contribute as part of a team to build and deploy threat detection and incident response capabilities. • Collaborate to design, build, and deploy solutions to automate security operations and incident response on AWS. • Develop high-quality content, such as reference architectures, white papers, and blog posts to help AWS customers secure their workloads. • Innovate on behalf of customers by translating your thoughts into action-driven results. • Mentor and invest in our team, partners and customers to raise the bar for our customers. • Periodic on-call required. About the team Diverse Experiences Amazon values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why AWS Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopted cloud platform. We pioneered cloud computing and never stopped innovating — that’s why customers from the most successful startups to Global 500 companies trust our robust suite of products and services to power their businesses. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve in the cloud. Inclusive Team Culture AWS values curiosity and connection. Our employee-led and company-sponsored affinity groups promote inclusion and empower our people to take pride in what makes us unique. Our inclusion events foster stronger, more collaborative teams. Our continual innovation is fueled by the bold ideas, fresh perspectives, and passionate voices our teams bring to everything we do. Mentorship and Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, mentorship and other career-advancing resources here to help you develop into a better-rounded professional. Basic Qualifications: - Experience with coding/scripting in one or more languages (e.g., Python, C, C++, Java, Ruby, or PowerShell) - Knowledge of networks, protocols, cloud and security fundamentals . - 2+ years of hands-on technical experience in threat detection, log collection and analysis, incident response, and/or security operations. Preferred Qualifications: - Experience with any combination of core security functions such as threat modeling, secure software development, data classification, identity management and authentication, cryptography, system administration, network security, and forensics. - Hands-on technical experience in building scripts, tools, or methodologies that enhance customers’ threat detection and incident response capabilities. - Experience with developing and training AI models. - Can communicate complex technical matters clearly and concisely orally and in writing. - Ability to manage customers expectations during security events, and deliver results. Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner. Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $125,500/year in our lowest geographic market up to $212,800/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit https://www.aboutamazon.com/workplace/employee-benefits . This position will remain posted until filled. Applicants should apply via our internal or external career site.", "summaryDescription" : "Associate Customer Incident Responder, AWS Customer Incident Response Team (CIRT) at Amazon Web Services, Inc.. Skills: Incident response, Threat detection, Security solutions. Support incident response operations. Become a technical resource", "postedDate" : "2026-06-13T08:42:48.387", "createdAt" : "2026-06-13T08:42:48.387", "lastUpdated" : "2026-06-15T03:07:34.087", "ingestTimestamp" : "2026-06-13T08:42:48.387", "mongoId" : "68e6b1d770f0b99d58d669d3", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/3103444/apply", "salaryAnnualMin" : 125500, "salaryAnnualMax" : 212800, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Log collection", "Log analysis", "Root cause analysis", "Preventative guidance", "Mentoring", "Incident response", "Threat detection", "Security solutions", "Security operations", "Cloud security", "Cloud environments", "Scalable computing architectures", "Security incidents", "Shared security model" ], "skillCount" : 14, "jobCategory" : "engineering", "dataQualityScore" : 0.8888889, "_score" : 822.4607, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology" }, { "id" : "68c2e423f8b1b0376634c56d", "title" : "Senior Incident Response Engineer, Devices & Services Security", "company" : "Amazon.com Services LLC", "industry" : "Systems, Quality, Security Engineering, Systems Security Engineering, amazon security", "salary" : { "min" : 143300.0, "max" : 247600.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Hawthorne, California, USA", "locations" : [ "Hawthorne, California, USA" ], "certifications" : [ "CISSP", "CISM", "CRISC", "GCIH", "CCIR", "GCDA" ], "timestamp" : "2026-06-15T08:13:32.312", "fingerprint" : "3317fe4da3a6f579d3a5ccdc8430939e8a2a28d3935ec2384cf4f9b32c5db032", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/3072356/apply", "externalId" : "2d1861cb-aa75-46c6-9067-b6a683645372", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Hawthorne", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "33.9128272,-118.3426122" } ], "locationText" : "Hawthorne, California, United States", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 10, "experienceLevel" : "Senior", "technicalSkills" : "AWS, WAF, EDR/XDR, Python, PowerShell, Bash, Splunk, SOAR, SQL", "professionalSkills" : [ "Incident response", "Detection engineering", "Security operations", "Threat hunting", "Risk assessment", "Root cause analysis" ], "hardSkillsList" : [ "Log analysis", "Network telemetry", "Attacker TTPs", "MITRE ATT&CK", "Scripting", "Automation", "Forensic analysis", "Malware analysis", "SQL queries" ], "softSkillsList" : [ "Judgment under pressure", "Calmness" ], "hardSkills" : [ { "name" : "Log analysis", "level" : "intermediate" }, { "name" : "Network telemetry", "level" : "intermediate" }, { "name" : "Attacker TTPs", "level" : "intermediate" }, { "name" : "MITRE ATT&CK", "level" : "intermediate" }, { "name" : "Scripting", "level" : "intermediate" }, { "name" : "Automation", "level" : "intermediate" }, { "name" : "Forensic analysis", "level" : "intermediate" }, { "name" : "Malware analysis", "level" : "intermediate" }, { "name" : "SQL queries", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Judgment under pressure" }, { "name" : "Calmness" } ], "majorSkills" : "Incident response, Security engineering, Detection engineering", "majorSkillsList" : [ "Incident response", "Security engineering", "Detection engineering" ], "coreResponsibilities" : "Investigate security incidents, Respond to security incidents, Drive rapid response, Drive effective response, Act as incident responder, Act as incident commander, Coordinate technical response, Keep stakeholders informed, Conduct post-mortem analysis, Identify root causes, Identify security improvement opportunities, Consult with builder teams, Ensure security designed into products, Collaborate with stakeholders, Execute incident response, Develop detections, Maintain detections, Respond to detections, Combat fraud, Combat abuse, Develop prevention capabilities, Develop detection capabilities, Develop response capabilities, Increase capability through automation, Increase efficiency through automation, Increase signal quality using AI/ML, Assist in runbook development, Assist in playbook tuning, Drive process improvements, Coordinate response efforts, Share learnings, Maintain WAF products, Support WAF products, Protect services from abuse, Drive WAF adoption, Evaluate WAF rules, Tune WAF rules, Develop SQL queries, Analyze log data, Extract information from logs, Extract information from databases, Extract information from services, Spearhead incident response, Drive decision-making, Conduct impact assessments, Implement containment strategies, Develop durable solutions, Proactively hunt threats, Create new detection mechanisms, Consult on security for new product designs, Analyze data, Identify hidden vulnerabilities", "teamCollaboration" : "Cross-functional teams; Global Amazon Security team; Other Incident Response teams", "projectManagementSkills" : [ "Runbook development", "Playbook tuning" ], "domainKnowledge" : "Devices and Services security; IoT platforms; Customer safety; Customer privacy; Fraud and abuse; Distributed systems; Cloud-native architectures; Service-oriented environments; IoT device security; Embedded systems", "domainList" : [ "devices-and-services-security", "iot-platforms", "customer-safety", "customer-privacy", "fraud-and-abuse", "distributed-systems", "cloud-native-architectures", "service-oriented-environments", "iot-device-security", "embedded-systems" ], "domainSpecificKnowledge" : [ "Devices and Services security", "IoT platforms", "Customer safety", "Customer privacy", "Fraud and abuse", "Distributed systems", "Cloud-native architectures", "Service-oriented environments", "IoT device security", "Embedded systems" ], "toolProficiency" : [ "AWS", "WAF", "EDR/XDR", "Splunk", "SOAR", "SQL" ], "communicationSkills" : "Clear communication; Stakeholder communication", "documentationSkills" : "Document work thoroughly; Contribute to post-incident reviews", "continuousLearning" : "Expand AI/ML skills", "innovationCreativity" : "Identify opportunities to raise the bar", "problemSolvingSkills" : "Problem-solvers; Investigative instincts; Troubleshooting", "specialRequirements" : "On-call rotation", "outcomesObjectives" : "Reduce or eliminate risk; Improve security for Amazon products; Improve security for Amazon services", "qualificationsBasic" : "5+ years cybersecurity experience, Incident response experience, Detection engineering experience, Security operations experience, Working knowledge of AWS, Working knowledge of WAF, Working knowledge of EDR/XDR tools, Working knowledge of network telemetry, Working knowledge of log analysis, Practical knowledge of attacker TTPs, Experience leveraging MITRE ATT&CK, Interpersonal skills, Communication skills, Proficiency with scripting, Proficiency with automation", "qualificationsPreferred" : "Proficiency with SIEM platform, Writing SIEM searches, Creating SIEM alerts, Analyzing SIEM log data, Forensic techniques, Threat hunting techniques, Identify adversary behavior, Detect anomalies, Analyze malware, Experience in large enterprise environments, Supporting multiple business lines, Experience securing distributed systems, Responding to incidents in distributed systems, Experience with cloud-native architectures, Experience with service-oriented environments, Experience with IoT device security, Experience with embedded systems forensics", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Are you ready to protect millions of homes and families as part of Amazon's elite Device Security Incident Response team? Join us in defending Ring, Blink, eero, and other industry-leading IoT platforms where every incident response decision impacts real people's safety and privacy. We’re looking for a seasoned security engineer to join a cross-functional Incident Response team supporting multiple Amazon devices brands. This is a hands-on role is focused on protecting the security and privacy of millions of customers by responding to incidents that impact real-world products and services. Our customers trust us with their safety and personal spaces, and it’s our responsibility to uphold that trust through strong, effective security practices. You will become a subject matter expert in the brands you support, leading our response to incidents through detection, assessment, containment, eradication, and post-mortem, while identifying opportunities to raise the bar on security for Amazon products and Customers. This high-visibility role requires clear communication, sound judgment under pressure, and the ability to work across organizational boundaries. You will be a strong advocate for customer safety and privacy, ensuring our devices deliver protection without compromise. You will document your work thoroughly, contribute to post-incident reviews, and collaborate with engineering teams to drive long-term improvements across the business. You will have opportunities to utilize, or expand your AI/ML skills, as we focus on automation. Key job responsibilities * Investigate and respond to security incidents in the Devices and Services org, setting the pace, and driving rapid, effective response that reduces or eliminates risk * Act as an incident responder or commander during active security events, coordinating technical response while keeping business stakeholders informed * Conduct thorough post-mortem analysis of security incidents, driving root cause identification, and identifying opportunities to improve security for Amazon products and services * Security consults with builder teams to ensure that security is designed into products from their inception * Collaborate with both technical, and non-technical stakeholders at all levels of the business, to execute rapid, and effective incident response * Develop, maintain, and respond to detections using Splunk/SOAR, as well as internal Amazon tooling * Combat various forms of fraud and abuse, by coordinating with business teams to develop comprehensive prevention/detection/response capabilities * Contribute to team efforts to increase capability and efficiency through automation of manual workloads and increase signal quality using AI/ML tools or approaches * Assist in runbook development, playbook tuning, and continuous process improvements * Participate in an on-call rotation (approx. two weekend days per month) * Work within a global, collaborative Amazon Security team where engineers and specialists support one another to solve complex problems and respond to security challenges together * Coordinate response efforts with other Incident Response teams at Amazon when appropriate, and share learnings * Maintain and support WAF products that protect Amazon services from abuse, drive adoption, evaluate or tune rules * Develop and update SQL queries to investigate security incidents, analyze log data, and extract relevant information from logs, databases and services. A day in the life As a Security Incident Response Engineer, you'll guide our team through complex security challenges impacting millions of customers. You'll: • Spearhead end-to-end incident response across Amazon's device ecosystem • Drive real-time decision-making during active incidents • Conduct impact assessments and implement containment strategies • Develop durable solutions with engineering teams • Proactively hunt threats and create new detection mechanisms • Consult on security for new product designs • Analyze data to identify hidden vulnerabilities We seek naturally curious problem-solvers who combine technical expertise with investigative instincts. You'll be the calm voice in the storm, transforming chaos into clarity and consistently safeguarding our customers' trust in Amazon's devices and services. About the team We're a tight-knit group of Security Engineers united by our mission to protect Amazon's customers. Though small, our impact is outsized. We've driven meaningful improvements across Amazon's device ecosystem through technical excellence and relentless customer advocacy. We're engineers first, approaching challenges with security expertise to create practical solutions. We champion \"better products\" over \"more products,\" solving problems collaboratively with empathy and partnership. We're not the team that just says \"no\" – we find secure paths forward. When incidents arise, we need our builders to feel relief when we arrive. We build bridges, not ivory towers, transforming security from a barrier into an enabler of innovation. Basic Qualifications: - * 5+ years of industry experience in cybersecurity, with a strong foundation in incident response, detection engineering, or security operations - * Working knowledge of AWS, WAF, EDR/XDR tools, network telemetry, and log analysis - * Practical knowledge of attacker tactics, techniques, and procedures (TTPs), with experience leveraging MITRE ATT&CK or similar frameworks to guide incident response or detection engineering - * Strong interpersonal and communication skills; able to calmly manage high-stakes coordination and decision-making - * Proficiency with scripting or automation (e.g., Python, PowerShell, Bash) Preferred Qualifications: - * Proficiency with at least one SIEM platform, including writing searches, creating alerts, and analyzing log data to support security investigations; experience with Splunk strongly preferred - * Exposure to AI/ML-driven anomaly detection, or behavior modeling tools - * Demonstrated ability to use forensic or threat hunting techniques to identify adversary behavior, detect anomalies, analyze potential malware to support containment and eradication - * Security certifications such as CISSP, CISM, CRISC, GCIH, CCIR, GCDA, etc. - * Prior experience in large enterprise environments or supporting multiple business lines - * Experience securing or responding to incidents in large-scale distributed systems, including cloud-native architectures and service-oriented environments - * Experience with IOT device security and embedded systems forensics Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Los Angeles County applicants: Job duties for this position include: work safely and cooperatively with other employees, supervisors, and staff; adhere to standards of excellence despite stressful conditions; communicate effectively and respectfully with employees, supervisors, and staff to ensure exceptional customer service; and follow all federal, state, and local laws and Company policies. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness and professionalism, and safeguard business operations and the Company’s reputation. Pursuant to the Los Angeles County Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner. Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $143,300/year in our lowest geographic market up to $247,600/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit https://www.aboutamazon.com/workplace/employee-benefits . This position will remain posted until filled. Applicants should apply via our internal or external career site.", "summaryDescription" : "Senior Incident Response Engineer, Devices & Services Security at Amazon.com Services LLC. Skills: Incident response, Security engineering, Detection engineering. Investigate security incidents. Respond to security incidents", "postedDate" : "2026-06-13T10:06:54.792", "createdAt" : "2026-06-13T10:06:54.792", "lastUpdated" : "2026-06-15T08:13:32.312", "ingestTimestamp" : "2026-06-13T10:06:54.792", "mongoId" : "68c2e423f8b1b0376634c56d", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/3072356/apply", "salaryAnnualMin" : 143300, "salaryAnnualMax" : 247600, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Log analysis", "Network telemetry", "Attacker TTPs", "MITRE ATT&CK", "Scripting", "Automation", "Forensic analysis", "Malware analysis", "SQL queries", "Judgment under pressure", "Calmness", "Incident response", "Security engineering", "Detection engineering", "Security operations", "Threat hunting", "Risk assessment", "Root cause analysis", "Runbook development", "Playbook tuning", "Devices and Services security", "IoT platforms", "Customer safety", "Customer privacy", "Fraud and abuse", "Distributed systems", "Cloud-native architectures", "Service-oriented environments", "IoT device security", "Embedded systems", "CISSP", "CISM", "CRISC", "GCIH", "CCIR", "GCDA", "AWS", "WAF", "EDR/XDR", "Splunk", "SOAR", "SQL" ], "skillCount" : 42, "jobCategory" : "engineering", "dataQualityScore" : 1.0, "_score" : 815.44006, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Security" }, { "id" : "69e104402beec4dd3def2577", "title" : "Security Engineer, AWS Security Incident Response", "company" : "Amazon Web Services", "industry" : "Solutions Architect, Systems Security Engineering, Cloud Computing", "salary" : { "min" : 135000.0, "max" : 195000.0, "currency" : "SGD", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market data for a Mid-level Security Engineer in Singapore, adjusted for the technology industry and a large company size." }, "location" : "SGP", "locations" : [ "SGP" ], "certifications" : [ "GCIH", "GSEC", "Security+" ], "timestamp" : "2026-06-15T02:22:21.224", "fingerprint" : "40bb89751ca82072e1830c381dd327c4aca04b10b3800fda172ae2e11fc89203", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/10386227/apply", "externalId" : "bf3e3eb2-1460-4e11-bafb-1fe3f4b46363", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Singapore", "country" : "Singapore", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "1.2899175,103.8519072" } ], "locationText" : "Singapore, Singapore", "employmentType" : "FULL_TIME", "minimumEducation" : "Bachelor's", "technicalSkills" : "AWS, Amazon GuardDuty, CrowdStrike Falcon, Wiz Defend", "professionalSkills" : [ "Security response", "Threat detection", "Incident response", "Security automation", "Security posture improvement", "Risk assessment", "Vulnerability assessment", "Remediation proposal" ], "hardSkillsList" : [ "Threat analysis", "Security monitoring", "Incident documentation", "Incident reporting", "Auto-remediation capabilities" ], "softSkillsList" : [ "Learning new concepts" ], "hardSkills" : [ { "name" : "Threat analysis", "level" : "intermediate" }, { "name" : "Security monitoring", "level" : "intermediate" }, { "name" : "Incident documentation", "level" : "intermediate" }, { "name" : "Incident reporting", "level" : "intermediate" }, { "name" : "Auto-remediation capabilities", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Learning new concepts" } ], "majorSkills" : "Incident response, Threat detection, Security automation", "majorSkillsList" : [ "Incident response", "Threat detection", "Security automation" ], "coreResponsibilities" : "Respond to threat findings, Identify security threats, Evaluate security threats, Communicate security threats, Propose remediation for security issues, Contribute to security automation development, Contribute to security posture improvements, Track effectiveness of detective controls, Report effectiveness of detective controls, Develop processes for response effectiveness, Develop policies for response effectiveness, Monitor networks for potential threats, Monitor systems for potential threats, Perform triage for security alerts, Document suspicious activity, Report security issues, Perform threat detection, Perform incident response, Detect cyber threats, Mitigate cyber threats, Protect AWS Customers, Learn new technologies, Learn new procedures", "teamCollaboration" : "Work alongside security engineers; Work with partner teams", "domainKnowledge" : "AWS Security; Incident response; Threat monitoring; Detective controls; Protective controls; Attack techniques; Cyber threats", "domainList" : [ "aws-security", "incident-response", "threat-monitoring", "detective-controls", "protective-controls", "attack-techniques", "cyber-threats" ], "domainSpecificKnowledge" : [ "AWS Security", "Incident response", "Threat monitoring", "Detective controls", "Protective controls", "Attack techniques", "Cyber threats" ], "toolProficiency" : [ "CrowdStrike Falcon", "Wiz Defend" ], "communicationSkills" : "Explain technical concepts", "documentationSkills" : "Document suspicious activity", "continuousLearning" : "Learning new concepts; Learning new technologies; Learning new procedures", "problemSolvingSkills" : "Work through ambiguity; Identify suspicious activity", "specialRequirements" : "On-call support, Periodic on-call responsibilities, On-call responsibilities including weekends", "outcomesObjectives" : "Keep customers secure; Increase security response effectiveness; Minimize disruption to customer workloads", "qualificationsBasic" : "Bachelor's degree in Engineering, Experience with web protocols, Experience with common security attacks, Experience with remediation, Knowledge of system, Knowledge of network, Knowledge of OS, Experience solving problems by writing code, Experience solving problems with scripts", "qualificationsPreferred" : "Experience with AWS services, Experience with other cloud offerings, Experience triaging security alerts, Front-line analysis experience, Escalation experience, GCIH certification, GSEC certification, Security+ certification", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "AWS Security Incident Response is looking for technical Security Engineers that are passionate about learning new concepts and work well within a team environment to keep customers secure. We value engineers that can work through ambiguity to identify suspicious activity, lead security response, and can explain technical security concepts to non-technical audiences. Key job responsibilities * Respond to threat findings that indicate unauthorized activity has occurred * Identify, evaluate and communicate security threats, risks and vulnerabilities, and propose recommended remediation for security issues. * Contribute to the development of security automation and security posture improvements. * Track and report on the effectiveness of AWS detective controls such as Amazon GuardDuty and partner products such as CrowdStrike Falcon or Wiz Defend * Develop processes and policies to increase security response effectiveness. * On-call support: This role requires periodic on-call responsibilities including weekends. A day in the life As a Security Engineer in AWS Security Incident Response, your responsibilities include monitoring networks and systems for potential threats, performing triage for security alerts, documenting suspicious activity, and reporting issues so they can be adequately handled. You will work alongside our security engineers and partner teams to perform daily threat detection and incident response, using the full capability of AWS technologies and services to detect and mitigate cyber threats at a massive scale and help protect AWS Customers. You should also enjoy learning about the most up-to-date new technologies and procedures to protect information systems and data. About the team AWS Security Incident Response provides 24/7 threat monitoring, investigation, and response across for customer’s AWS environments. The service enhances existing security capabilities by providing security monitoring for all native AWS services and supports vendor agnostic detective and protective controls to provide holistic security controls for customers. This is done by leveraging data on common attack techniques to enhance detective controls and incident response, then building auto-remediation capabilities to minimize disruption to customer workloads. When a security event does happen, you will be there provide guidance. Basic Qualifications: - Bachelor's degree in Engineering, Computer Science, or a related field - Experience with web protocols, common security attacks, and remediation (non-internship) - Knowledge of system, network and OS - Experience solving basic problems by writing code or scripts with some assistance Preferred Qualifications: - Experience with AWS services or other cloud offerings - Experience triaging security alerts, front-line analysis, and escalation - GCIH (GIAC Certified Incident Handler) or GSEC (GIAC Security Essentials) or Security+ Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Security Engineer, AWS Security Incident Response at Amazon Web Services. Skills: Incident response, Threat detection, Security automation. Respond to threat findings. Identify security threats", "postedDate" : "2026-06-13T04:14:17.343", "createdAt" : "2026-06-13T04:14:17.343", "lastUpdated" : "2026-06-15T02:22:21.224", "ingestTimestamp" : "2026-06-13T04:14:17.343", "mongoId" : "69e104402beec4dd3def2577", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/10386227/apply", "salaryBand" : "100k-150k", "hasSalary" : false, "allSkills" : [ "Threat analysis", "Security monitoring", "Incident documentation", "Incident reporting", "Auto-remediation capabilities", "Learning new concepts", "Incident response", "Threat detection", "Security automation", "Security response", "Security posture improvement", "Risk assessment", "Vulnerability assessment", "Remediation proposal", "AWS Security", "Threat monitoring", "Detective controls", "Protective controls", "Attack techniques", "Cyber threats", "GCIH", "GSEC", "Security+", "CrowdStrike Falcon", "Wiz Defend" ], "skillCount" : 25, "jobCategory" : "engineering", "dataQualityScore" : 0.8888889, "_score" : 808.5967, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology" }, { "id" : "6a2a45a674d8ee00a05d300f", "title" : "Tier 3 Support Engineer", "company" : "Voxel", "industry" : "Customer Success", "salary" : { "min" : 125000.0, "max" : 150000.0, "currency" : "USD", "frequency" : "Yearly" }, "location" : "Remote", "locations" : [ "Remote" ], "certifications" : [ "Network+", "Security+", "AWS Cloud Practitioner" ], "timestamp" : "2026-06-13T08:09:11.050", "fingerprint" : "20e218dd16697f5584a40ee3df10e0f0e8c3326f07758613134e4f8295b217ed", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/voxel/5add9292-1fb1-42ec-b327-5373f63a26ea/application", "externalId" : "5add9292-1fb1-42ec-b327-5373f63a26ea", "industryFunction" : { }, "structuredLocations" : [ { "workMode" : "remote" } ], "locationText" : "", "employmentType" : "FULL_TIME", "experienceMinYears" : 2, "experienceMaxYears" : 4, "experienceLevel" : "Senior", "domainKnowledge" : "Edge hardware; Networking; AI inference; Cloud infrastructure; IoT architectures; Computer vision; Video analytics", "domainList" : [ "edge-hardware", "networking", "ai-inference", "cloud-infrastructure", "iot-architectures", "computer-vision", "video-analytics" ], "domainSpecificKnowledge" : [ "Edge hardware", "Networking", "AI inference", "Cloud infrastructure", "IoT architectures", "Computer vision", "Video analytics" ], "communicationSkills" : "Executive communication; Clear communication; Decisive guidance", "remoteFriendly" : true, "workSiteFlexibility" : "Remote", "rawDescription" : "WHO WE ARE Industrial labor powers our world and protecting the people who do that work is both a moral imperative and a business advantage. At Voxel, we're transforming workplace safety and operational efficiency through AI-driven computer vision technology that helps organizations see unseen risks before incidents occur. Voxel's platform enables Fortune 500 safety and operations leaders to uncover root causes, drive proactive risk reduction, and make smarter, data-driven decisions. Our Solutions Engineering team ensures customers successfully adopt, deploy, and scale Voxel across complex enterprise environments. THE ROLE As a Tier 3 Support Engineer at Voxel, you are the deepest technical escalation point in our support organization, the last line of defense before Engineering. You will own the most complex, high-severity issues across our platform, working at the code and infrastructure level to diagnose root causes and drive permanent fixes. You'll serve as a critical bridge between Support, Engineering, and Product, influencing how we build for reliability and scale. This role is built for a seasoned engineer who combines deep technical expertise with strong customer instincts and a passion for solving problems others can't. WHAT YOU'LL DO - Own resolution of the most complex, high-severity escalations across Voxel's platform, including issues spanning edge hardware, networking, AI inference, and cloud infrastructure. - Conduct root cause analysis at the code, configuration, and infrastructure level, partnering directly with Engineering to drive permanent fixes. - Act as the authoritative technical escalation point for Tier 2, Customer Success, and Solutions Engineering teams. - Interface directly with enterprise customer IT, security, and engineering stakeholders during critical incidents, providing clear communication and decisive guidance. - Contribute to platform improvements by identifying systemic failure patterns and advocating for engineering investments that reduce support burden. - Define and maintain advanced troubleshooting frameworks, escalation criteria, and internal knowledge resources for the broader support organization. - Drive post-incident reviews and ensure learnings are documented and acted upon across teams. - Participate in on-call rotations for critical escalations and high-priority customer environments. WHAT WE'RE LOOKING FOR Required Qualifications - 2- 4 years of experience in technical support engineering, site reliability engineering, or a senior infrastructure/platform role. - Deep expertise in networking and systems (TCP/IP, routing, firewalls, VPNs, Linux internals, edge/IoT architectures). - Ability to read and navigate source code (Python, Typescript, Go, and SQL) to diagnose issues and collaborate effectively with engineering teams and push PRs to edit configuration files - Proven track record of owning and resolving high-severity, multi-stakeholder incidents end-to-end. - Strong executive communication skills; able to lead technical bridges with enterprise customers under pressure. - Experience building internal technical documentation, escalation frameworks, or support tooling. Nice to Have - Hands-on experience with AI/ML inference pipelines, computer vision systems, or video analytics platforms. - Familiarity with cloud infrastructure and observability tooling (AWS/Azure/GCP, Datadog, Grafana, etc.). - Background in warehouse, logistics, manufacturing, or industrial environments. - Relevant certifications (Network+, Security+, AWS Cloud Practitioner). WHY JOIN US? Join a visionary team revolutionizing safety and operations, directly impacting the well-being of millions of essential workers. This is your chance to build an extraordinary business and foster a vibrant company culture that demands your absolute best. Alongside AI experts, experienced entrepreneurs, and passionate problem-solvers, you'll play a pivotal role in shaping the company's growth trajectory and market position. Benefits: - Extensive / generous health, dental, and vision insurance - Highly competitive paid parental leave and support system - Ownership in the business through an Equity Incentive Plan - Generous paid time off and / or flexible work arrangements - Daily meals in-office, vibrant company events, team-building - 401K retirement plan, HSA options, pre-tax commuter benefits", "summaryDescription" : "Tier 3 Support Engineer at Voxel", "postedDate" : "2026-06-11T18:28:00.068", "createdAt" : "2026-06-11T18:28:00.068", "lastUpdated" : "2026-06-13T08:09:11.050", "ingestTimestamp" : "2026-06-11T18:28:00.068", "mongoId" : "6a2a45a674d8ee00a05d300f", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 125000, "salaryAnnualMax" : 150000, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Edge hardware", "Networking", "AI inference", "Cloud infrastructure", "IoT architectures", "Computer vision", "Video analytics", "Network+", "Security+", "AWS Cloud Practitioner" ], "skillCount" : 10, "jobCategory" : "customer-service", "jobSubcategory" : "customer-success", "dataQualityScore" : 1.0, "_score" : 803.8186, "daysOld" : 1, "hasLocation" : true, "hasGeo" : false, "llmIndustry" : "Workplace safety" }, { "id" : "6a25145474d8ee00a00bb3b2", "title" : "Senior Security Engineer, AWS Security Incident Response", "company" : "Amazon Web Services Japan GK", "industry" : "Systems, Quality, Security Engineering, Systems Security Engineering, Cloud Computing", "salary" : { "min" : 1.2E7, "max" : 1.8E7, "currency" : "JPY", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market data for a Senior Security Engineer in Tokyo, Japan, adjusted for AWS's size and the technology industry." }, "location" : "Tokyo, JPN", "locations" : [ "Tokyo, JPN" ], "certifications" : [ "GCIH", "GSEC", "GREM", "GCFA", "CISSP" ], "timestamp" : "2026-06-15T08:24:56.602", "fingerprint" : "a57d3db022abec12088d7bb9660b2ed2ff73f018f6b5050988fd19a160c05a1a", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10441597/apply", "externalId" : "79b6888c-343c-4289-bbab-a95d6a41e1f2", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Tokyo", "country" : "Japan", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "35.6768601,139.7638947" } ], "locationText" : "Tokyo, Japan", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 10, "experienceLevel" : "Senior", "technicalSkills" : "Python, Java, C++, AWS, Amazon GuardDuty, AWS CloudTrail, AWS Security Hub, AWS IAM", "professionalSkills" : [ "Malware analysis", "Forensic analysis", "Attribution skills", "System design", "Automation development", "Detection engineering", "Incident response", "Threat monitoring", "Security operations" ], "hardSkillsList" : [ "Scripting", "Programming", "Code review", "Log analysis", "Automation", "Command line tools", "Security issue identification", "Risk assessment", "Mitigation planning", "Vulnerability identification", "Attack pattern analysis", "Remediation" ], "softSkillsList" : [ "Mentoring" ], "hardSkills" : [ { "name" : "Scripting", "level" : "intermediate" }, { "name" : "Programming", "level" : "intermediate" }, { "name" : "Code review", "level" : "intermediate" }, { "name" : "Log analysis", "level" : "intermediate" }, { "name" : "Automation", "level" : "intermediate" }, { "name" : "Command line tools", "level" : "intermediate" }, { "name" : "Security issue identification", "level" : "intermediate" }, { "name" : "Risk assessment", "level" : "intermediate" }, { "name" : "Mitigation planning", "level" : "intermediate" }, { "name" : "Vulnerability identification", "level" : "intermediate" }, { "name" : "Attack pattern analysis", "level" : "intermediate" }, { "name" : "Remediation", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Mentoring" } ], "majorSkills" : "Security Incident Response, Automation, AI Feedback Loops, Detection Engineering", "majorSkillsList" : [ "Security Incident Response", "Automation", "AI Feedback Loops", "Detection Engineering" ], "coreResponsibilities" : "Build automation mechanisms, Investigate complex security incidents, Build frameworks for scalable detection, Build frameworks for auto-remediation, Architect AI feedback loops, Respond to threats, Build detection enhancements, Build auto-remediation playbooks, Build AI training pipelines, Lead incident response for customers, Scope blast radius, Coordinate containment, Guide remediation, Walk customers through compromises, Build pipelines to capture investigation patterns, Translate patterns into detection rules, Translate patterns into auto-remediation, Measure impact on investigation volume, Measure impact on investigation accuracy, Build mechanisms for engineer contribution, Build AI feedback loops, Improve autonomous investigation accuracy, Define and track metrics, Measure automation effectiveness, Reduce false positives, Increase auto-resolution coverage, Track engineer contribution rates, Mentor junior engineers, Structure artifacts as reusable automation inputs, Participate in on-call rotations, Review automation dashboard metrics, Investigate new attack patterns, Analyze malware behavior, Extract indicators, Build detection rules, Step into high-severity incidents, Analyze logs, Correlate indicators across accounts, Codify attack chains, Improve AI agent performance, Review and approve detection rule contributions", "teamCollaboration" : "Cross-functional teams; Leadership collaboration", "projectManagementSkills" : [ "Roadmap planning" ], "domainKnowledge" : "Attack patterns; Supply chain attacks; Cryptomining; Cloud-native architecture; Security operations", "domainList" : [ "attack-patterns", "supply-chain-attacks", "cryptomining", "cloud-native-architecture", "security-operations" ], "domainSpecificKnowledge" : [ "Attack patterns", "Supply chain attacks", "Cryptomining", "Cloud-native architecture", "Security operations" ], "toolProficiency" : [ "AWS" ], "communicationSkills" : "Customer calls; Executive presentations", "continuousLearning" : "One-on-one coaching", "innovationCreativity" : "Prototype development", "problemSolvingSkills" : "Root cause analysis; Troubleshooting; Data-driven decision making", "specialRequirements" : "On-call rotation, 24/7 follow-the-sun operating model", "outcomesObjectives" : "Reduce false positives; Increase auto-resolution coverage; Improve autonomous investigation accuracy", "qualificationsBasic" : "5+ years scripting, programming, or security code review, Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or other related discipline, Speak, write, and read fluently in Japanese, 5+ years troubleshooting systems issues, analyzing logs, automating complex tasks using command line tools, and identifying security issues, risks, and developing mitigation plans, Experience in industry-based security vulnerabilities identification, attack patterns, and remediation, Experience as a mentor, tech lead, or leading an engineering team", "qualificationsPreferred" : "Master's degree in Computer Science, Information Security, or a related field, Experience in automation or monitoring frameworks, deployment or development, Information security professional certification (GCIH, GSEC, GREM, GCFA, CISSP, or equivalent), Experience with AWS services in a security operations context", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "AWS Security Incident Response is looking for a Senior Security Engineer who builds the automation mechanisms that scale security response. You will investigate complex security incidents hands-on, build the frameworks that turn investigation expertise into scalable detection and auto-remediation, and architect the AI feedback loops that make the service smarter with every investigation. The AWS Security Incident Response team provides 24/7 security response through a follow-the-sun operating model. The service combines automated triage workflows, AI-powered investigation agents, and human security analysts to respond to threats across customer AWS environments at massive scale. Our AI systems autonomously resolve over 90% of routine investigations within minutes. The next challenge is building the mechanisms that accelerate this further — enabling every engineer on the team to contribute to detection and automation quality from their investigation work. Your deep understanding of how attacks work — from initial exploitation through lateral movement to data exfiltration — is what makes your automation effective. You will build detection enhancements, auto-remediation playbooks, and AI training pipelines that catch real threats, not just generate noise. We treat every investigation as a confirmed security incident until the data proves otherwise. Native Japanese language skills and fluent English language skills in speaking, reading, and writing. Key job responsibilities - Investigate and respond to complex security incidents hands-on — applying malware analysis, forensic analysis, or attribution skills to credential compromise, data exfiltration, supply chain attacks, and cryptomining - Lead incident response for customers during high-severity events: scope blast radius, coordinate containment, guide remediation, and get on calls with customers to walk them through what was compromised and the specific steps to contain the threat - Own the response-to-automation flywheel: build pipelines that capture investigation patterns (including Trust & Safety abuse cases), translate them into detection rules and auto-remediation, and measure impact on investigation volume and accuracy - Build mechanisms that enable every engineer on the team to contribute detection rules, automation playbooks, and AI training data — and build the AI feedback loops that ensure human corrections systematically improve autonomous investigation accuracy - Define and track metrics that measure automation effectiveness: false positive reduction, auto-resolution coverage, and engineer contribution rates to the pipeline - Mentor junior engineers on investigation methodology and structuring artifacts as reusable automation inputs - Participate in on-call rotations as part of the 24/7 follow-the-sun operating model, including weekends A day in the life - Review automation dashboard metrics: AI agent resolution rates, false positive trends, and engineer-submitted detection rules going live - Investigate new attack patterns the AI is struggling with — analyze malware behavior, extract indicators, and build detection rules that catch the pattern without generating false positives - Step into high-severity incidents directly — analyzing logs, correlating indicators across accounts, scoping blast radius, and getting on a call with the customer to guide containment - Codify attack chains from investigations into detection rules and AI agent improvements so the system catches the pattern autonomously next time - Review and approve detection rule contributions from junior engineers using your contribution framework About the team The AWS Security Incident Response team provides 24/7 threat monitoring, investigation, and response for customer AWS environments. The team is driving a strategic transformation — raising operational standards, building AI-powered investigation capabilities, and expanding coverage. We respond to customer requests within minutes. Zero queue tolerance is the operating standard. We value engineers who solve root causes over those who close tickets. Senior engineers enjoy close collaboration with leadership, one-on-one coaching, and the opportunity to shape the future of security operations at AWS scale. Basic Qualifications: - 5+ years of scripting, programming, or security code review in a common language, such as Python, Java or C++ experience - Bachelor's degree or above in Computer Science, Computer Engineering, Cybersecurity, or other related discipline - Speak, write, and read fluently in Japanese - 5+ years of non-internship experience in troubleshooting systems issues, analyzing logs, automating complex tasks using command line tools, and identifying security issues, risks, and developing mitigation plans - Experience (non-internship) in industry-based security vulnerabilities identification, attack patterns, and remediation techniques; including experience as a mentor, tech lead, or leading an engineering team Preferred Qualifications: - Master's degree in Computer Science, Information Security, or a related field - Experience in automation or monitoring frameworks, deployment or development - Knowledge of compliance and security standards across the enterprise IT landscape - * Information security professional certification (GCIH, GSEC, GREM, GCFA, CISSP, or equivalent) - * Experience with AWS services in a security operations context (Amazon GuardDuty, AWS CloudTrail, AWS Security Hub, AWS IAM) Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Senior Security Engineer, AWS Security Incident Response at Amazon Web Services Japan GK. Skills: Security Incident Response, Automation, AI Feedback Loops, Detection Engineering. Build automation mechanisms. Investigate complex security incidents", "postedDate" : "2026-06-13T18:41:50.371", "createdAt" : "2026-06-13T18:41:50.371", "lastUpdated" : "2026-06-15T08:24:56.602", "ingestTimestamp" : "2026-06-13T18:41:50.371", "mongoId" : "6a25145474d8ee00a00bb3b2", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10441597/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Scripting", "Programming", "Code review", "Log analysis", "Automation", "Command line tools", "Security issue identification", "Risk assessment", "Mitigation planning", "Vulnerability identification", "Attack pattern analysis", "Remediation", "Mentoring", "Security Incident Response", "AI Feedback Loops", "Detection Engineering", "Malware analysis", "Forensic analysis", "Attribution skills", "System design", "Automation development", "Detection engineering", "Incident response", "Threat monitoring", "Security operations", "Roadmap planning", "Attack patterns", "Supply chain attacks", "Cryptomining", "Cloud-native architecture", "GCIH", "GSEC", "GREM", "GCFA", "CISSP", "AWS" ], "skillCount" : 36, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Senior", "dataQualityScore" : 1.0, "_score" : 798.93567, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.98 }, { "id" : "6a2c7bd274d8ee00a094b368", "title" : "Incident Commander, Program Manager", "company" : "Block", "industry" : "FinTech", "salary" : { "min" : 175000.0, "max" : 245000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior Incident Commander, Program Manager in Oakland, CA, adjusted for Block's size and the FinTech industry." }, "location" : "US - CA - Oakland", "locations" : [ "US - CA - Oakland" ], "timestamp" : "2026-06-15T03:42:48.826", "fingerprint" : "68a553691f3791e241a3cc080c0d0cd3be79c274b2d15d91becd333ede12ad4a", "source" : "greenhouse", "language" : "en", "applyUrl" : "http://block.xyz/careers/jobs/5124221008?gh_jid=5124221008", "externalId" : "5124221008", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Oakland", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "37.8044557,-122.2713560" } ], "locationText" : "Oakland, California, United States", "experienceMinYears" : 7, "experienceMaxYears" : 10, "experienceLevel" : "Senior", "professionalSkills" : [ "Process management", "Cross-functional coordination", "Vendor management", "Stakeholder management", "Operational metrics", "Resource planning", "Continuous improvement" ], "majorSkills" : "Incident management, Crisis response, Program management", "majorSkillsList" : [ "Incident management", "Crisis response", "Program management" ], "coreResponsibilities" : "Lead incident commander, Direct real-time response, Coordinate cross-functional teams, Accountability for incident escalation, Accountability for containment, Accountability for remediation, Accountability for resolution, Document incident timelines, Maintain incident timelines, Document key decisions, Maintain key decisions, Document supporting evidence, Maintain supporting evidence, Oversee incident report preparation, Manage internal communication channels, Share accurate updates, Facilitate post-incident reviews, Identify lessons learned, Improve incident preparedness, Improve incident response", "teamCollaboration" : "Cross-functional teams; Legal; Compliance; Engineering; Product; Customer Success", "projectManagementSkills" : [ "Project management" ], "domainKnowledge" : "Economic empowerment; Operational resilience; Responsible innovation", "domainList" : [ "economic-empowerment", "operational-resilience", "responsible-innovation" ], "domainSpecificKnowledge" : [ "Economic empowerment", "Operational resilience", "Responsible innovation" ], "documentationSkills" : "Incident reports", "qualificationsBasic" : "7+ years incident management, 5+ years project management", "rawDescription" : "Block is one company built from many blocks, all united by the same purpose of economic empowerment. The blocks that form our foundational teams — People, Finance, Counsel, Hardware, Information Security, Platform Infrastructure Engineering, and more — provide support and guidance at the corporate level. They work across business groups and around the globe, spanning time zones and disciplines to develop inclusive People policies, forecast finances, give legal counsel, safeguard systems, nurture new initiatives, and more. Every challenge creates possibilities, and we need different perspectives to see them all. Bring yours to Block. The Role Block's Critical Incident Management Team (CIMT) plays an important role in protecting our operations, customers, and regulatory standing in the face of significant business incidents. As our organization continues to grow, we are expanding our incident command capabilities to ensure fast, coordinated, and effective responses to high-impact events. As an Incident Commander within the Risk organization, you will be at the center of Block's response to complex, high-stakes incidents, helping maintain our operational resilience and uphold our commitment to responsible innovation. You Will Be the lead incident commander for high-severity incidents across Block's ecosystem, including fraud events, customer-impacting issues, regulatory matters, and escalated incidents. Direct the real-time response and coordination among cross-functional teams such as Legal, Compliance, Engineering, Product, and Customer Success Be the central point of accountability for incident escalation, containment, remediation, and resolution Document and maintain detailed incident timelines, key decisions, and supporting evidence throughout the lifecycle of the incident Oversee the preparation of final incident reports Manage internal communication channels and ensure accurate, updates are shared with stakeholders at all levels Facilitate post-incident reviews to identify lessons learned and improve incident preparedness and response You Have 7 + years of Proven experience in incident management, crisis response, or a related role within a high-stakes operational environment 5+ years of Project management, especially under time-sensitive and high-pressure conditions Understanding of regulatory and compliance considerations in the financial services or technology space We're working to build a more inclusive economy where our customers have equal access to opportunity, and we strive to live by these same values in building our workplace. Block is an equal opportunity employer evaluating all employees and job applicants without regard to identity or any legally protected class. We will consider qualified applicants with arrest or conviction records for employment in accordance with state and local laws and “fair chance” ordinances. We believe in being fair, and are committed to an inclusive interview experience, including providing reasonable accommodations to disabled applicants throughout the recruitment process. We encourage applicants to share any needed accommodations with their recruiter, who will treat these requests as confidentially as possible. Want to learn more about what we're doing to build a workplace that is fair and square? Check out our I+D page. While there is no specific deadline to apply for this role, U. S. roles are typically open for an average of 55 days before being filled by a successful candidate. Please refer to the date listed at the top of this job page for when this role was first posted. Block takes a market-based approach to pay, and pay may vary depending on your location. U. S. locations are categorized into one of four zones based on a cost of labor index for that geographic area. The successful candidate’s starting pay will be determined based on job-related skills, experience, qualifications, work location, and market conditions. These ranges may be modified in the future. To find a location’s zone designation, please refer to this resource. If a location of interest is not listed, please speak with a recruiter for additional information. Zone A: $163,600—$245,400 USD Zone B: $152,200—$228,200 USD Zone C: $144,000—$216,000 USD Zone D: $135,800—$203,600 USD Application Guidelines Candidates may submit up to 9 active applications within a 60-day period. Reapplications to the same role are accepted 90 days after a previous application has been reviewed. Use of AI in Our Hiring Process We may use automated AI tools to evaluate job applications for efficiency and consistency. These tools comply with local regulations, including bias audits, and we handle all personal data in accordance with state and local privacy laws. Contact us here with hiring practice or data usage questions. Every benefit we offer is designed with one goal: empowering you to do the best work of your career while building the life you want. Remote work, medical insurance, flexible time off, retirement savings plans, and modern family planning are just some of our offering. Check out our other benefits at Block. Block, Inc. (NYSE: XYZ) builds technology to increase access to the global economy. Each of our brands unlocks different aspects of the economy for more people. Square makes commerce and financial services accessible to sellers. Cash App is the easy way to spend, send, and store money. Afterpay is transforming the way customers manage their spending over time. TIDAL is a music platform that empowers artists to thrive as entrepreneurs. Bitkey is a simple self-custody wallet built for bitcoin. Proto is a suite of bitcoin mining products and services. Together, we’re helping build a financial system that is open to everyone. Privacy Policy", "summaryDescription" : "Incident Commander, Program Manager at Block. Skills: Incident management, Crisis response, Program management. Lead incident commander. Direct real-time response", "postedDate" : "2026-06-13T20:34:06.477", "createdAt" : "2026-06-13T20:34:06.477", "lastUpdated" : "2026-06-15T03:42:48.826", "ingestTimestamp" : "2026-06-13T20:34:06.477", "mongoId" : "6a2c7bd274d8ee00a094b368", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 175000, "salaryAnnualMax" : 245000, "salaryBand" : "150k-200k", "hasSalary" : true, "allSkills" : [ "Incident management", "Crisis response", "Program management", "Process management", "Cross-functional coordination", "Vendor management", "Stakeholder management", "Operational metrics", "Resource planning", "Continuous improvement", "Project management", "Economic empowerment", "Operational resilience", "Responsible innovation" ], "skillCount" : 14, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Senior", "dataQualityScore" : 0.8888889, "_score" : 798.8241, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "FinTech", "llmIndustryConfidence" : 0.95 }, { "id" : "69d5e4962beec4dd3d931981", "title" : "AWS Security Operations/Incident Response Engineer", "company" : "Amazon Web Services, Inc.", "industry" : "Systems, Quality, Security Engineering, Systems Security Engineering, Cloud Computing", "salary" : { "min" : 136000.0, "max" : 184000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : false }, "location" : "Herndon, Virginia, USA", "locations" : [ "Herndon, Virginia, USA" ], "certifications" : [ "GCIH", "GSEC", "Security+" ], "timestamp" : "2026-06-15T02:08:07.757", "fingerprint" : "0c97d9ed2d550c199650d60b2166fb48eb0e947fd71728e016fa19334f04915f", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/10385139/apply", "externalId" : "f0a1c5b4-3fd4-4296-8fb3-027521c0d98b", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Herndon", "state" : "Virginia", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "38.9695316,-77.3859479" } ], "locationText" : "Herndon, Virginia, United States", "employmentType" : "FULL_TIME", "technicalSkills" : "Cryptography, Network security, Software security, Malware analysis, Forensics, Security operations, Incident response, Security intelligence", "professionalSkills" : [ "Risk assessment", "Information security" ], "hardSkillsList" : [ "Log analysis", "Forensics", "System development", "Tool development" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "Log analysis", "level" : "intermediate" }, { "name" : "Forensics", "level" : "intermediate" }, { "name" : "System development", "level" : "intermediate" }, { "name" : "Tool development", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Incident response, Security operations, Cloud security", "majorSkillsList" : [ "Incident response", "Security operations", "Cloud security" ], "coreResponsibilities" : "Respond to security incidents, Prevent future incidents, Design security responses, Coordinate security responses, Build security utilities, Build security tools, Communicate effectively, Instill best practices", "teamCollaboration" : "Multiple teams across organization; Security engineers", "domainKnowledge" : "Cloud security; National security program", "domainList" : [ "cloud-security", "national-security-program" ], "domainSpecificKnowledge" : [ "Cloud security", "National security program" ], "communicationSkills" : "Communicate at multiple levels", "problemSolvingSkills" : "Think like attacker; Think like defender", "specialRequirements" : "On-call responsibilities, US Citizen, TS/SCI with polygraph", "qualificationsBasic" : "Associate's degree or above, GCIH or GSEC or Security+, Current, active US Government Security Clearance of TS/SCI with Polygraph, US Citizen", "qualificationsPreferred" : "Experience with AWS products and services", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Amazon Web Services (AWS) is the leading cloud provider, providing virtual infrastructure, storage, networking, messaging, and many other services to customers all over the world. AWS runs a globally distributed environment, operating at massive levels of scale. Businesses, from start-ups to enterprises, run their operations and applications on AWS’s multi-tenant infrastructure. Governmental organizations are also looking to and depending on AWS for cloud solutions and services. The AWS Security Incident Response team is seeking a focused Security Engineer who can take on a leadership role in responding to security issues in support of our National Security program. This engineer will work as a part of a growing team of security engineers who are focused on protecting the AWS infrastructure that is used by our national security customers. Our security engineers perform many duties during an average day: log analysis, incident response, forensics, system/tooling development, and risk assessment, just to name a few. You must thrive in high-pressure situations, think like both an attacker and defender, and drive relevant teams to take the right actions in the right time frames to mitigate risks. They also need to balance technical risks against business needs and be able to articulate risks and mitigations to members of leadership at various levels. You should have a good mix of deep technical knowledge and a demonstrated background in information security. We value broad and deep technical knowledge, specifically in the fields of cryptography, network security, software security, malware analysis, forensics, security operations, incident response, and emergent security intelligence. This position requires that the candidate selected be a US Citizen and must currently possess and maintain an active TS/SCI security clearance with polygraph. Key job responsibilities You should be able to accomplish most of the following: - Confidently and intelligently respond to security incidents, and proactively consider how to prevent the same type of incidents from occurring in the future. - Design and coordinate cohesive responses to security events that involve multiple teams across the organization. - Build security utilities and tools for internal use that enable you and your fellow Security Engineers to operate at high speed and wide scale. - Ability to communicate effectively at multiple levels of sensitivity, and multiple audiences. - Recognize, adopt and instill the best practices in security engineering fields throughout the organization: development, cryptography, network security, security operations, incident response, security intelligence. - Fulfill regular on-call responsibilities. About the team Diverse Experiences Amazon Security values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why Amazon Security? At Amazon, security is central to maintaining customer trust and delivering delightful customer experiences. Our organization is responsible for creating and maintaining a high bar for security across all of Amazon’s products and services. We offer talented security professionals the chance to accelerate their careers with opportunities to build experience in a wide variety of areas including cloud, devices, retail, entertainment, healthcare, operations, and physical stores. Inclusive Team Culture In Amazon Security, it’s in our nature to learn and be curious. Ongoing DEI events and learning experiences inspire us to continue learning and to embrace our uniqueness. Addressing the toughest security challenges requires that we seek out and celebrate a diversity of ideas, perspectives, and voices. Training & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, training, and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why flexible work hours and arrangements are part of our culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve. Basic Qualifications: - Associate's degree or above - GCIH (GIAC Certified Incident Handler) or GSEC (GIAC Security Essentials) or Security+ - Current, active US Government Security Clearance of TS/SCI with Polygraph Preferred Qualifications: - Experience with AWS products and services Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status. Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner. The base salary range for this position is listed below. Your Amazon package will include sign-on payments and restricted stock units (RSUs). Final compensation will be determined based on factors including experience, qualifications, and location. Amazon also offers comprehensive benefits including health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage), 401(k) matching, paid time off, and parental leave. Learn more about our benefits at https://amazon.jobs/en/benefits . USA, VA, Herndon - 136,000.00 - 184,000.00 USD annually", "summaryDescription" : "AWS Security Operations/Incident Response Engineer at Amazon Web Services, Inc.. Skills: Incident response, Security operations, Cloud security. Respond to security incidents. Prevent future incidents", "postedDate" : "2026-06-13T01:35:14.469", "createdAt" : "2026-06-13T01:35:14.469", "lastUpdated" : "2026-06-15T02:08:07.757", "ingestTimestamp" : "2026-06-13T01:35:14.469", "mongoId" : "69d5e4962beec4dd3d931981", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/10385139/apply", "salaryAnnualMin" : 136000, "salaryAnnualMax" : 184000, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Log analysis", "Forensics", "System development", "Tool development", "Leadership", "Incident response", "Security operations", "Cloud security", "Risk assessment", "Information security", "National security program", "GCIH", "GSEC", "Security+" ], "skillCount" : 14, "jobCategory" : "engineering", "dataQualityScore" : 0.8888889, "_score" : 797.4881, "daysOld" : 2, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology" }, { "id" : "6a2ecc1474d8ee00a0eba9ea", "title" : "Multi-lingual Escalation Specialist, Global Security Operations Center", "company" : "ADCI", "industry" : "Supply Chain/Transportation Management, Real Estate/Facilities, amazon security", "salary" : { "min" : 1200000.0, "max" : 1800000.0, "currency" : "INR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Mid-level Multi-lingual Escalation Specialist in Bengaluru, India, adjusted for the technology industry and company size." }, "location" : "Bengaluru, Karnataka, IND", "locations" : [ "Bengaluru, Karnataka, IND" ], "timestamp" : "2026-06-15T23:59:37.793", "fingerprint" : "70e45cc3c94765f9dde75f9a5e996c8e02b31ef8680528d707d1ab0f3161d83b", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10448437/apply", "externalId" : "752dc3cb-7aad-4bef-a0b3-725a009094ba", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Bengaluru", "state" : "Karnataka", "country" : "India", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "12.9767936,77.5900820" } ], "locationText" : "Bengaluru, Karnataka, India", "employmentType" : "FULL_TIME", "minimumEducation" : "High school or equivalent diploma", "professionalSkills" : [ "Incident triage", "Crisis management", "Workplace violence triage", "Information flow facilitation" ], "hardSkillsList" : [ "Alarm monitoring", "Incident response", "Report writing" ], "softSkillsList" : [ "Composure" ], "hardSkills" : [ { "name" : "Alarm monitoring", "level" : "intermediate" }, { "name" : "Incident response", "level" : "intermediate" }, { "name" : "Report writing", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Composure" } ], "majorSkills" : "Escalation management, Incident triage, Crisis management", "majorSkillsList" : [ "Escalation management", "Incident triage", "Crisis management" ], "coreResponsibilities" : "Provide support to delivery associates, Provide support to customers, Research and troubleshoot with internal tools, Triage and prioritize incoming incidents, Collaborate with crisis management leadership, Transfer lower severity calls, Manage phone communications, Facilitate information flow between customers, Write clear and concise reports", "teamCollaboration" : "Cross-functional coordination; Vendor management; Stakeholder management", "domainKnowledge" : "Security operations; Operational risks; Physical assets; Brand protection; Workplace violence", "domainList" : [ "security-operations", "operational-risks", "physical-assets", "brand-protection", "workplace-violence" ], "domainSpecificKnowledge" : [ "Security operations", "Operational risks", "Physical assets", "Brand protection", "Workplace violence" ], "toolProficiency" : [ "Microsoft Office", "InfoPath", "SharePoint" ], "communicationSkills" : "Oral skills; Writing skills", "documentationSkills" : "Report writing", "problemSolvingSkills" : "Troubleshooting; Judgment", "specialRequirements" : "Weekends, Nights, Holidays", "qualificationsBasic" : "High school or equivalent diploma, Knowledge of Microsoft Office products, Work a flexible schedule/shift/work area, Experience in an IT/operations/call/command center work environment, Read, write and speak Telugu, Hindi and English", "qualificationsPreferred" : "Experience in resolving conflicts, Experience providing crisis management triage, Experience setting appropriate expectations with customers, Experience multitasking, Experience answering multiple phone lines, Experience prioritizing e-mail, instant message, and ticket related communication, Experience communicating clearly within a command center environment, 6+ months of customer service experience, Intermediate fluency in Telugu, Intermediate fluency in Hindi, Intermediate fluency in English, Bachelor’s degree, Experience working in fast paced environments, Experience managing workload during stress", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "The mission of Amazon Global Security Operations Centre (GSOC) is to mitigate security and operational risks to our associates, physical assets, and brand. GSOC supports Amazon Worldwide Stores by providing 24/7 services including alarm monitoring and response, incident triage, and crisis management. Amazon is hiring an Escalation Specialist at GSOC- India office. The Escalation Specialist will work directly with customers, law enforcement, delivery associates, and operations to navigate and triage security and operational risks, while providing critical incident and workplace violence triage, coordination, and facilitation. Key job responsibilities • Provide support to delivery associates on-road, and customers receiving shipments or services from Amazon, by researching and troubleshooting with internal tools. • Triage and prioritize incoming incidents and collaborate with crisis management leadership. • Transfer lower severity calls, which can be a significant percentage of total call volume, to appropriate partner including Customer Service and Shipping/Delivery • Manage phone communications and facilitate the flow of information between various internal and external customers (Delivery Associates/Delivery Service Providers/Operations Managers/Customer Service Associates/Amazon Customers). • Write clear and concise reports in a timely manner which in turn will be escalated to senior leadership and stakeholders. A day in the life judgment, and be gifted at learning new technology. Demonstrating ownership, customer obsession, and concise oral and writing skills are crucial requirements for this role. We have a 5-day work week but given the 7 days a week operation, the 2 scheduled days off will vary based on shift patterns and business needs. Basic Qualifications: - High school or equivalent diploma - Knowledge of Microsoft Office products and applications, including Word, PowerPoint, Excel, Outlook, InfoPath, SharePoint, etc. - Work a flexible schedule/shift/work area, including weekends, nights, and/or holidays - Experience in an IT/operations/call/command center work environment - Can read, write and speak Telugu, Hindi and English - Demonstrates effective composure, empathy, and a positive, professional attitude Preferred Qualifications: - Experience in resolving conflicts, providing crisis management triage, and setting appropriate expectations with customers - Experience multitasking, including answering multiple phone lines, prioritize e-mail, instant message, and ticket related communication, and communicate clearly within a command center environment - 6+ months of customer service experience, to include answering multiple phone lines and ticket related communication in a Command Center work environment - Intermediate fluency in one or more of the following languages Telugu, Hindi and English - Bachelor’s degree – Preferably in Criminal Justice, Political Science, Crisis Management or Business Administration - Experience in resolving conflicts, providing crisis management triage, and setting appropriate expectations with customers - Experience working in fast paced environments, and managing workload even during times of stress, or escalated activity Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Multi-lingual Escalation Specialist, Global Security Operations Center at ADCI. Skills: Escalation management, Incident triage, Crisis management. Provide support to delivery associates. Provide support to customers", "postedDate" : "2026-06-14T00:00:00.000", "createdAt" : "2026-06-14T21:59:26.527", "lastUpdated" : "2026-06-15T23:59:37.793", "ingestTimestamp" : "2026-06-14T21:59:26.527", "mongoId" : "6a2ecc1474d8ee00a0eba9ea", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10448437/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Alarm monitoring", "Incident response", "Report writing", "Composure", "Escalation management", "Incident triage", "Crisis management", "Workplace violence triage", "Information flow facilitation", "Security operations", "Operational risks", "Physical assets", "Brand protection", "Workplace violence", "Microsoft Office", "InfoPath", "SharePoint" ], "skillCount" : 17, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Mid", "dataQualityScore" : 0.8888889, "_score" : 789.4442, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "693072a570f0b99d58ffb6e6", "title" : "BBM Escalation Specialist, Amazon Maintenance Operation Centre", "company" : "ADCI HYD 16 SEZ - H83", "industry" : "Facilities, Maintenance, Real Estate, Real Estate/Facilities, fulfillment ops", "salary" : { "min" : 750000.0, "max" : 1200000.0, "currency" : "INR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for an E-Commerce company in Hyderabad, India, adjusted for mid-seniority level." }, "location" : "Hyderabad, Telangana, IND", "locations" : [ "Hyderabad, Telangana, IND" ], "timestamp" : "2026-06-14T23:42:51.309", "fingerprint" : "267b0ae4fef21a3d8b0cdb4c82cf9baa1b63eed291877141138fbe66895ca89d", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/3134989/apply", "externalId" : "644ae785-ca03-4461-bccb-0e42861cc9ad", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Hyderabad", "state" : "Telangana", "country" : "India", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "17.3605890,78.4740613" } ], "locationText" : "Hyderabad, Telangana, India", "employmentType" : "FULL_TIME", "minimumEducation" : "High school diploma or equivalent", "technicalSkills" : "Microsoft Office Suite", "professionalSkills" : [ "Facilities management", "Vendor management", "Technical support", "Work order management" ], "hardSkillsList" : [ "CMMS systems" ], "softSkillsList" : [ "Attention to detail" ], "hardSkills" : [ { "name" : "CMMS systems", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Attention to detail" } ], "majorSkills" : "Escalation management, Vendor dispatch, Monitoring and response", "majorSkillsList" : [ "Escalation management", "Vendor dispatch", "Monitoring and response" ], "coreResponsibilities" : "Respond to and triage incoming work requests, Manage remote works from start to end, Raise and receipt work orders/purchase orders, Communicate effectively and efficiently with stakeholders, Provide updates on vendor status, Coordinate works during an escalation, Identify and escalate critical issues, Monitor, respond to, and manage refrigeration alarm systems, Manage and prioritize work queues, Coordinate with local vendors and maintenance teams, Execute emergency response procedures, Document all actions, Maintain accurate case records, Support continuous improvement initiatives", "teamCollaboration" : "Cross-functional teams", "domainKnowledge" : "Building maintenance systems; Refrigeration systems; Electrical systems; HVAC systems; Building automation systems", "domainList" : [ "building-maintenance-systems", "refrigeration-systems", "electrical-systems", "hvac-systems", "building-automation-systems" ], "domainSpecificKnowledge" : [ "Building maintenance systems", "Refrigeration systems", "Electrical systems", "HVAC systems", "Building automation systems" ], "toolProficiency" : [ "CMMS systems" ], "communicationSkills" : "Written communication; Verbal communication", "documentationSkills" : "Case records", "problemSolvingSkills" : "Problem-solving skills; Analytical skills", "specialRequirements" : "24/7 shift environment", "outcomesObjectives" : "Maintain equipment reliability; Minimize operational impact; Ensure timely resolution of facility issues", "qualificationsBasic" : "High school diploma or equivalent, Experience in technical support, facilities management, or related field, Problem-solving and analytical skills, Excellent written and verbal communication abilities, Proficiency in Microsoft Office Suite, Experience with CMMS systems and work order management, Ability to work in a 24/7 shift environment, Customer service oriented with attention to detail", "qualificationsPreferred" : "Associate's degree in technical field or equivalent experience, Knowledge of building maintenance systems, Experience with vendor/contractor management, Multi-lingual capabilities, Previous experience in a command center or operations environment, Familiarity with building automation systems", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "We are seeking a dedicated Base Building Maintenance Escalation Specialist to join our Amazon Maintenance Operations Centre (AMOC) team. This role is essential in providing 24/7 monitoring and response for our global facility network, ensuring continuous operation through effective vendor management and technical support. The successful candidate will be responsible for first-line monitoring, vendor dispatch coordination, and escalation management across multiple Amazon business units. Key job responsibilities • Respond to and triage incoming work requests within standard service level agreements (SLAs) • Manage remote works from start to end, including work order/purchase order raising and receipting • Communicate effectively and efficiently with stakeholders (Reliability Maintenance Engineering, Ops, H&S etc.) • Provide updates on vendor status, take the lead on coordinating works during an escalation • Identify and escalate critical issues through appropriate channels to maintain equipment reliability and minimize operational impact • Monitor, respond to, and manage refrigeration alarm systems, ensuring timely response to critical alerts • Manage and prioritize work queues based on urgency and SLA requirements • Coordinate with local vendors and maintenance teams to ensure timely resolution of facility issues • Execute emergency response procedures during critical facility incidents • Document all actions and maintain accurate case records • Support continuous improvement initiatives for processes and procedures Basic Qualifications: - High school diploma or equivalent - Experience in technical support, facilities management, or related field - Strong problem-solving and analytical skills - Excellent written and verbal communication abilities - Proficiency in Microsoft Office Suite - Experience with CMMS systems and work order management - Ability to work in a 24/7 shift environment - Customer service oriented with strong attention to detail Preferred Qualifications: - Associate's degree in technical field or equivalent experience - Knowledge of building maintenance systems (HVAC, refrigeration, electrical) - Experience with vendor/contractor management - Multi-lingual capabilities - Previous experience in a command center or operations environment - Familiarity with building automation systems Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "BBM Escalation Specialist, Amazon Maintenance Operation Centre at ADCI HYD 16 SEZ - H83. Skills: Escalation management, Vendor dispatch, Monitoring and response. Respond to and triage incoming work requests. Manage remote works from start to end", "postedDate" : "2026-06-13T06:23:38.145", "createdAt" : "2026-06-13T06:23:38.145", "lastUpdated" : "2026-06-14T23:42:51.309", "ingestTimestamp" : "2026-06-13T06:23:38.145", "mongoId" : "693072a570f0b99d58ffb6e6", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/3134989/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "CMMS systems", "Attention to detail", "Escalation management", "Vendor dispatch", "Monitoring and response", "Facilities management", "Vendor management", "Technical support", "Work order management", "Building maintenance systems", "Refrigeration systems", "Electrical systems", "HVAC systems", "Building automation systems" ], "skillCount" : 14, "jobCategory" : "data", "dataQualityScore" : 0.8888889, "_score" : 785.85345, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true }, { "id" : "6a191e7758b93c861e39f718", "title" : "Service Integration & Management - Problem Management", "industry" : "Technology", "salary" : { "min" : 1850000.0, "max" : 3150000.0, "currency" : "INR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for Service Integration & Management roles in Bangalore, India, adjusted for senior seniority and technology industry." }, "location" : "India-Karnataka-Bangalore", "locations" : [ "India-Karnataka-Bangalore", "Brigade Tech Gardens, Katha No. 119, Kundalahalli Village, K.R. Puram Hobli, Ward No. 85, Bangalore" ], "certifications" : [ "ITIL v3/v4 Foundation", "ITIL Managing Professional", "ITIL Intermediate (Release, Control & Validation)", "SIAM Foundation", "SIAM Professional", "COBIT", "ISO/IEC 20000" ], "timestamp" : "2026-06-15T09:08:05.193", "fingerprint" : "1db18b2cccc62e0b2701748781cbf5145aaf3aa3c210069e8eb676e5bf43461e", "source" : "taleo", "language" : "en", "applyUrl" : "https://tas-daimler.taleo.net/careersection/ex/jobdetail.ftl?job=896774", "externalId" : "896774", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Bangalore", "state" : "Karnataka", "country" : "India", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "12.9767936,77.5900820" } ], "locationText" : "Bangalore, Karnataka, India", "minimumEducation" : "Bachelor's", "experienceMinYears" : 7, "experienceMaxYears" : 12, "experienceLevel" : "Senior", "domainKnowledge" : "ITIL best practices; SIAM operating model; ITIL processes; Change Management; Release Management; Incident Management; Problem Management; Configuration Management; IT governance frameworks", "domainList" : [ "itil-best-practices", "siam-operating-model", "itil-processes", "change-management", "release-management", "incident-management", "problem-management", "configuration-management", "it-governance-frameworks" ], "domainSpecificKnowledge" : [ "ITIL best practices", "SIAM operating model", "ITIL processes", "Change Management", "Release Management", "Incident Management", "Problem Management", "Configuration Management", "IT governance frameworks" ], "communicationSkills" : "Executive-level reporting", "remoteFriendly" : false, "rawDescription" : "Position Overview: a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } The SIAM Problem Manager is responsible for governing, coordinating, and assuring the end‑to‑end IT Problem Management process across multiple service providers within a SIAM operating model. The role ensures that recurring incidents and underlying root causes are systematically identified, analyzed, and eliminated to minimize service disruption and improve service stability. This role acts as a key integrator between internal IT teams, external vendors, and business stakeholders, ensuring adherence to ITIL best practices, effective root cause analysis (RCA), and organizational governance while driving continual service improvement. a { text-decoration: none; color: #464feb; } tr th, tr td { border: 1px solid #e6e6e6; } tr th { background-color: #f5f5f5; } Responsibilities Own and manage the end‑to‑end Problem Management process within the SIAM framework. Ensure consistent application of problem management policies, RCA standards, and governance across all service providers. Coordinate cross‑supplier and cross‑tower problem investigations , including Major Incident–driven problems. Act as the single point of accountability for integrated problem resolution, root cause validation, and corrective/preventive actions. Lead and facilitate Problem Review meetings , RCA workshops, and post‑incident analysis sessions. Ensure high‑quality root cause analysis , impact assessment, and sustainable corrective and preventive actions (CAPA). Track, challenge, and govern problem remediation plans to closure, including vendor accountability. Communicate effectively with technical teams, operations, and business stakeholders , including executive‑level reporting on problem trends and risk. Support audit, compliance, and regulatory requirements related to problem management. Analyze problem performance metrics such as recurring incidents, backlog ageing, RCA quality, and repeat failures . Drive Continual Service Improvement (CSI) initiatives based on trend analysis, proactive problem identification, and systemic weaknesses. Education & Experience Qualification Education: Bachelor’s degree in Information Technology, Computer Science, Engineering, or a related field. Master’s degree (MBA/MS in Information Systems, IT Management, or Operations) is an added advantage. ITIL v3/v4 Foundation certification (mandatory); ITIL Managing Professional or ITIL Intermediate (Release, Control & Validation) preferred. SIAM Foundation/Professional certification is desirable. Additional certifications in COBIT, ISO/IEC 20000, or IT governance frameworks are a plus. Experience: 7–12 years of overall IT experience, with at least 4–6 years in problem Management, Service Management, or IT Operations within an enterprise environment. Proven experience working in a SIAM or multi-vendor ecosystem with responsibility for integrated change governance. In-depth understanding of ITIL processes, especially Change, Release, Incident, Problem, and Configuration Management. Experience analyzing change performance metrics (change success rate, emergency changes, failed changes, change collisions) and driving improvement initiatives. Exposure to regulatory, audit, and compliance requirements related to IT change governance. Experience using ITSM tools such as ServiceNow, BMC Remedy, or similar platforms. Strong stakeholder management experience, including communication with senior leadership and external service providers. Experience in global delivery environments and cross-functional collaboration is preferred. Mercedes-Benz Research and Development India Private Limited", "summaryDescription" : "Service Integration & Management - Problem Management", "createdAt" : "2026-06-14T08:47:39.289", "lastUpdated" : "2026-06-15T09:08:05.193", "ingestTimestamp" : "2026-06-14T08:47:39.289", "mongoId" : "6a191e7758b93c861e39f718", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "ITIL best practices", "SIAM operating model", "ITIL processes", "Change Management", "Release Management", "Incident Management", "Problem Management", "Configuration Management", "IT governance frameworks", "ITIL v3/v4 Foundation", "ITIL Managing Professional", "ITIL Intermediate (Release, Control & Validation)", "SIAM Foundation", "SIAM Professional", "COBIT", "ISO/IEC 20000" ], "skillCount" : 16, "jobCategory" : "operations", "jobSubcategory" : "general", "seniorityLevel" : "Senior", "dataQualityScore" : 0.6666667, "_score" : 782.7586, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2cb0c074d8ee00a09daf1c", "title" : "Security Engineer, Detection and Response", "company" : "Serval", "industry" : "Engineering", "salary" : { "min" : 200000.0, "max" : 325000.0, "currency" : "USD", "frequency" : "Yearly" }, "location" : "San Francisco", "locations" : [ "San Francisco" ], "timestamp" : "2026-06-15T09:19:56.220", "fingerprint" : "14803e741daf8986e22ba67efd869ed1db5cb9f7c1f099fcc2a20c6ed18f6f72", "source" : "ashby", "language" : "en", "applyUrl" : "https://jobs.ashbyhq.com/Serval/5250c679-d490-407e-bd2e-b8b160c62aac/application", "externalId" : "5250c679-d490-407e-bd2e-b8b160c62aac", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San Francisco", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "37.7879363,-122.4075201" } ], "locationText" : "San Francisco, California, United States", "employmentType" : "FULL_TIME", "experienceMinYears" : 8, "experienceMaxYears" : 15, "experienceLevel" : "Lead", "technicalSkills" : "Cloud telemetry, Logging", "professionalSkills" : [ "Detection engineering", "Incident response", "Security operations", "Threat intelligence", "Observability", "Program management" ], "hardSkillsList" : [ "Adversary tradecraft", "Detection strategies", "Response actions" ], "softSkillsList" : [ "Leadership", "Mentoring" ], "hardSkills" : [ { "name" : "Adversary tradecraft", "level" : "intermediate" }, { "name" : "Detection strategies", "level" : "intermediate" }, { "name" : "Response actions", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" }, { "name" : "Mentoring" } ], "majorSkills" : "Detection engineering, Incident response, Security operations, Team leadership", "majorSkillsList" : [ "Detection engineering", "Incident response", "Security operations", "Team leadership" ], "coreResponsibilities" : "Design detection and response operations, Implement detection and response operations, Operate detection and response operations, Monitor security events, Triage security events, Investigate security events, Contain security events, Remediate security events, Build a team, Lead a team, Mentor a team, Hire functions, Scale functions, Ensure operational rigor, Ensure operational readiness, Improve detection quality, Improve detection coverage, Partner with engineering teams, Ensure telemetry availability, Ensure telemetry reliability, Ensure telemetry actionability, Embed detection and response, Build security program", "teamCollaboration" : "Partner with Engineering; Partner with Product; Partner with Infrastructure", "domainKnowledge" : "Modern observability stacks; Modern adversary tradecraft; Cloud environments; Corporate environments; Production environments", "domainList" : [ "modern-observability-stacks", "modern-adversary-tradecraft", "cloud-environments", "corporate-environments", "production-environments" ], "domainSpecificKnowledge" : [ "Modern observability stacks", "Modern adversary tradecraft", "Cloud environments", "Corporate environments", "Production environments" ], "communicationSkills" : "Written communication; Verbal communication", "innovationCreativity" : "Use Serval's agents", "qualificationsBasic" : "10+ years cybersecurity, Deep expertise detection engineering, Deep expertise incident response, Deep expertise security operations, Deep experience building teams, Deep experience leading teams, Stellar leadership skills, Demonstrated history driving improvements, Exceptional written communication, Exceptional verbal communication, Remain calm under pressure, Effectively run incidents, Deep expertise observability stacks, Deep expertise detection primitives, Understand modern adversary tradecraft, Experience translating TTPs, Experience into detection strategies, Experience into response actions", "qualificationsPreferred" : "Experience with SIEM, Experience with data lakes, Experience with EDR, Experience with cloud telemetry, Experience with logging", "rawDescription" : "WHO WE ARE Serval http://serval.com is an AI-native automation platform transforming how enterprises operate. We build intelligent agents that understand real-world workflows and execute them end-to-end — replacing manual processes and rigid legacy systems with adaptive, learning software. Founded in early 2024, Serval is already trusted by companies like Fox, Notion, Perplexity, Vercel, and Brex to automate high-volume, high-friction operational work across their organizations. At the core of Serval is an agentic AI platform that turns natural language into production-grade workflows. Our agents don’t just respond to requests — they reason, take action across systems, and continuously improve with usage. What began with operational use cases has quickly evolved into a horizontal AI automation layer used across IT, HR, Finance, Security, Legal, and Engineering. Our mission is to eliminate repetitive, manual work across the enterprise and give teams leverage through intelligent automation. Long term, we’re building the universal AI operations layer — a system of agents that sits across business functions and runs the workflows that keep modern companies moving. We’re backed by leading investors including Sequoia Capital, Redpoint Ventures, Meritech, First Round, General Catalyst, Elad Gil, and others. ROLE OVERVIEW As Detection and Response Lead, you'll build and scale the foundations of Serval's cybersecurity detection and response operations. You will set the strategy and drive execution for security monitoring, incident response, recovery, and post-incident improvement across our infrastructure and the systems our customers trust us to operate in. You'll be a hands-on leader with deep technical credibility and strong operational instincts. You will build and mentor a team, partner closely with Engineering and Product, and ensure that detection and response capabilities are embedded by design into the systems that power Serval. WHAT YOU'LL DO - Design, implement, and operate detection and response operations, including continuous monitoring, triage, investigation, containment, and remediation of security events across a diverse set of networks and infrastructure. - Build, lead, and directly mentor a team spanning observability, detection and response, and threat intelligence, hiring and scaling these functions deliberately and proportionately as Serval's platform and customer footprint grow. - Ensure world-class operational rigor and readiness through incident playbooks, on-call and escalation paths, tabletop exercises, and continuous improvement of response quality and speed. - Improve detection quality and coverage by partnering with engineering teams to ensure critical telemetry is available, reliable, and actionable across cloud, corporate, and production environments. - Partner deeply across Engineering, Product, and Infrastructure to embed detection and response into Serval's systems by design rather than as an afterthought. - Build a security program capable of withstanding sophisticated adversaries, including by using Serval's own agents to solve frontier security and security-operations problems. WHAT YOU'LL NEED - Have 10+ years in cybersecurity with deep expertise in detection engineering, incident response, and security operations. - Have deep experience building and leading detection and response, instrumentation/observability, and threat intelligence teams. - Have stellar leadership skills and a demonstrated history of driving durable, continuous improvements to programs, processes, and people. - Have exceptional written and verbal communication skills, can remain calm under pressure, and can effectively run command of security incidents involving numerous stakeholders across a diverse gamut of teams, expertise, and seniority. - Have deep expertise in modern observability stacks (e.g., SIEM, data lakes, EDR, cloud telemetry, logging) and detection primitives. - Understand modern adversary tradecraft (TTPs) and have demonstrated experience translating it into practical detection strategies and response actions. - Are mission-oriented, have unimpeachable integrity, and are passionate about detecting and responding to adversaries in a highly complex, fast-paced environment. WHAT WE OFFER - Impact: Be a key player in shaping the success of our product and company. - Growth: Build a fundamentally new AI product offering with the support of our experienced team and investors. Grow rapidly with the company. - Culture: Join a culture that values innovation, ownership, accountability, and fun.", "summaryDescription" : "Security Engineer, Detection and Response at Serval. Skills: Detection engineering, Incident response, Security operations, Team leadership. Design detection and response operations. Implement detection and response operations", "createdAt" : "2026-06-14T03:16:25.185", "lastUpdated" : "2026-06-15T09:19:56.220", "ingestTimestamp" : "2026-06-14T03:16:25.185", "mongoId" : "6a2cb0c074d8ee00a09daf1c", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 200000, "salaryAnnualMax" : 325000, "salaryBand" : "200k+", "hasSalary" : true, "allSkills" : [ "Adversary tradecraft", "Detection strategies", "Response actions", "Leadership", "Mentoring", "Detection engineering", "Incident response", "Security operations", "Team leadership", "Threat intelligence", "Observability", "Program management", "Modern observability stacks", "Modern adversary tradecraft", "Cloud environments", "Corporate environments", "Production environments" ], "skillCount" : 17, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Director", "dataQualityScore" : 0.8888889, "_score" : 779.0955, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2a660674d8ee00a062b8f7", "title" : "Sr. SLP manager, Centralized Monitoring and Response System- CMRS", "company" : "ADCI", "industry" : "Investigation Loss Prevention, Fulfillment Center, Logistics", "salary" : { "min" : 2200000.0, "max" : 3500000.0, "currency" : "INR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Manager in Logistics in Bengaluru, India, adjusted for seniority and company size." }, "location" : "Bengaluru, Karnataka, IND", "locations" : [ "Bengaluru, Karnataka, IND" ], "timestamp" : "2026-06-15T06:00:01.039", "fingerprint" : "39adfd1310a624db73185e3de1076aea5046bc96d11cbd8b3484d147c5171f03", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10443646/apply", "externalId" : "cab48901-468c-4ddd-a14c-c117d816e78d", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Bengaluru", "state" : "Karnataka", "country" : "India", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "12.9767936,77.5900820" } ], "locationText" : "Bengaluru, Karnataka, India", "employmentType" : "FULL_TIME", "minimumEducation" : "Bachelor's", "experienceMinYears" : 5, "experienceLevel" : "Manager", "technicalSkills" : "MS Office, MS Excel", "professionalSkills" : [ "Loss prevention", "Asset protection", "Investigations", "Process audit", "Risk assessment", "Security due diligence", "Business partner assessment", "Third party logistics", "Delivery service providers", "Security awareness", "Threat assessment", "Risk management", "Intelligence", "Incident management", "Supply chain security" ], "hardSkillsList" : [ "CCTV analysis", "Process compliance", "Metric-based strategies", "Continuous improvement" ], "softSkillsList" : [ "Leadership" ], "hardSkills" : [ { "name" : "CCTV analysis", "level" : "intermediate" }, { "name" : "Process compliance", "level" : "intermediate" }, { "name" : "Metric-based strategies", "level" : "intermediate" }, { "name" : "Continuous improvement", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" } ], "majorSkills" : "Monitoring and Response, Loss Prevention, Incident Response, Process Compliance", "majorSkillsList" : [ "Monitoring and Response", "Loss Prevention", "Incident Response", "Process Compliance" ], "coreResponsibilities" : "Drive measurable financial impact, Assist field SLP investigations, Provide CCTV analysis, Support package rescue-recovery actions, Identify bad actors, Support law enforcement referrals, Innovate and operate at scale, Manage complex stakeholder relationships, Continuously innovate system capabilities, Expand system capabilities into new geographies, Expand system capabilities into new use cases, Provide guidance for Security and Loss Prevention operations, Provide coordination for supply chain, Provide coordination for logistics, Provide coordination for transportation operations, Coordinate with other stakeholders, Coordinate with third parties, Deploy risk assessment methodologies, Address current risks, Address foreseeable risks, Identify security strategies, Conduct security due diligence assessments, Implement key liaison contacts, Maintain awareness of legislation, Provide tactical response to legislation, Provide tactical response to industry trends, Provide tactical response to external risks, Provide tactical response to new technologies, Ensure compliance to internal standards, Support Global Security Risk Compliance Audit team, Define requirements for Last Mile, Collaborate in conducting internal security audits, Provide expertise in conducting internal security audits, Implement effective audit programs, Detect security incidents, Prevent security incidents, Resolve security incidents, Implement guidance for conducting audits, Assess Last Mile Security of business partners, Assess Last Mile Security of vendors, Assess Last Mile Security of third party logistics, Assess Last Mile Security of carriers, Follow up on corrective action plans, Implement corrective action plans, Support internal business stakeholders, Promote security as added value, Provide direct input to internal stakeholders, Provide direct input to operational teams, Provide security input regarding selection of third party, Implement key collaborations with regional stakeholders, Implement consistent standards for the network, Implement consistent programs for the network, Implement consistent assessments for the network, Implement consistent procedures for the network, Implement and maintain relationships with affiliate management, Implement and maintain relationships with international partners, Contribute expertise for implementation of security awareness campaigns, Contribute expertise for implementation of specific training packages, Contribute to reduce business losses, Identify vulnerabilities, Understand vulnerabilities, Identify MO's, Understand MO's, Implement appropriate means to protect transported assets, Implement appropriate measures to protect transported assets, Act as lead interface for wholesalers, Act as lead interface for third party providers, Implement strategies to prevent theft, Implement strategies to prevent diversion, Implement strategies to prevent losses, Partner with internal stakeholders, Partner with external stakeholders", "teamCollaboration" : "Manage complex stakeholder relationships; Coordinate with Operations; Coordinate with Legal; Coordinate with Employee Relations; Coordinate with PXT teams; Coordinate with supply chain; Coordinate with logistics; Coordinate with transportation; Coordinate with third parties; Collaborate with business partners; Collaborate with vendors; Collaborate with DSPs; Collaborate with carriers; Collaborate with internal stakeholders; Collaborate with regional stakeholders; Collaborate with affiliate management; Collaborate with international partners", "projectManagementSkills" : [ "Continuous improvement concepts" ], "domainKnowledge" : "Security and Loss Prevention; Supply chain; Logistics; Transportation; Last Mile operations; Middle Mile operations; Fulfillment Centers; Grocery & Specialty Fulfillment; Centralized monitoring; Incident response; Process audit frameworks; Loss prevention interventions; Crisis response; Operational process compliance; Security operations; Risk assessment methodologies; Last mile itineraries; Business partner due diligence; Third party logistics; Delivery service providers; Industry trends; External risks; New technologies; Global Security Risk Compliance; Business partner security; Vendor security; Carrier security; Transportation security; Sortation security; Delivery security; Corrective action plans; High risk business initiatives; Security awareness campaigns; Threat and risk assessment; Risk management; Loss prevention; Intelligence and MO's; Incident management; Investigations; Security incidents; Related claims; Transported assets", "domainList" : [ "security-and-loss-prevention", "supply-chain", "logistics", "transportation", "last-mile-operations", "middle-mile-operations", "fulfillment-centers", "grocery-specialty-fulfillment", "centralized-monitoring", "incident-response", "process-audit-frameworks", "loss-prevention-interventions", "crisis-response", "operational-process-compliance", "security-operations", "risk-assessment-methodologies", "last-mile-itineraries", "business-partner-due-diligence", "third-party-logistics", "delivery-service-providers", "industry-trends", "external-risks", "new-technologies", "global-security-risk-compliance", "business-partner-security", "vendor-security", "carrier-security", "transportation-security", "sortation-security", "delivery-security", "corrective-action-plans", "high-risk-business-initiatives", "security-awareness-campaigns", "threat-and-risk-assessment", "risk-management", "loss-prevention", "intelligence-and-mo-s", "incident-management", "investigations", "security-incidents", "related-claims", "transported-assets" ], "domainSpecificKnowledge" : [ "Security and Loss Prevention", "Supply chain", "Logistics", "Transportation", "Last Mile operations", "Middle Mile operations", "Fulfillment Centers", "Grocery & Specialty Fulfillment", "Centralized monitoring", "Incident response", "Process audit frameworks", "Loss prevention interventions", "Crisis response", "Operational process compliance", "Security operations", "Risk assessment methodologies", "Last mile itineraries", "Business partner due diligence", "Third party logistics", "Delivery service providers", "Industry trends", "External risks", "New technologies", "Global Security Risk Compliance", "Business partner security", "Vendor security", "Carrier security", "Transportation security", "Sortation security", "Delivery security", "Corrective action plans", "High risk business initiatives", "Security awareness campaigns", "Threat and risk assessment", "Risk management", "Loss prevention", "Intelligence and MO's", "Incident management", "Investigations", "Security incidents", "Related claims", "Transported assets" ], "toolProficiency" : [ "MS Office", "MS Excel" ], "innovationCreativity" : "Pioneering innovation; Drive innovation; Continuously innovate", "problemSolvingSkills" : "Focused investigations; Data-driven investigation; Root cause analysis", "specialRequirements" : "24/7 monitoring operations", "outcomesObjectives" : "Deliver loss prevention interventions; Deliver crisis and incident response; Deliver operational process compliance; Protect Amazon's customers; Protect Amazon's associates; Protect Amazon's assets; Reduce business losses", "qualificationsBasic" : "5+ years security service, 5+ years loss prevention, 5+ years asset protection, 5+ years investigations, 5+ years law enforcement, 2+ years Amazon experience, 3+ years people management, 3+ years implementing metric-based strategies, Experience with MS Office Professional Suite, Excellent working knowledge of MS Excel, Bachelor's degree or equivalent, 5+ years relevant professional experience, 5+ years military experience", "qualificationsPreferred" : "Experience using Microsoft Excel for data analysis, Experience using Microsoft Excel for formulae, Experience using Microsoft Excel for data visualization", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Amazon is seeking an experienced and dynamic leader to manage the Integrated Centralized Monitoring & Response System (iCMRS) — a pioneering innovation within Amazon's Security and Loss Prevention (SLP) organization. The iCMRS is a unified platform that integrates monitoring and response capabilities across all miles of Amazon's supply chain, including Last Mile (AMZL), Middle Mile (ATS), Fulfillment Centers (FC), and Grocery & Specialty Fulfillment (GSF). Operating from a centralized Control Center in Bangalore, the system leverages remote CCTV monitoring, data-driven investigation tools, and process audit frameworks to deliver loss prevention interventions, crisis and incident response, and operational process compliance across 190+ sites in India, Singapore, and Japan. As the iCMRS Manager, you will lead a team of 8 direct reports and oversee 90+ contractual specialists responsible for 24/7 monitoring operations, focused investigations, proactive process audits, and real-time incident response. This is a high-impact role offering the opportunity to shape the future of centralized security operations at Amazon, drive innovation in loss prevention technology, and deliver results that directly protect Amazon's customers, associates, and assets. Key job responsibilities • You will be accountable for driving measurable financial impact by assisting field SLP investigations with tailor-fit CCTV analysis that results in package rescue-recovery actions, identification of bad actors, and supporting law enforcement referrals. • The role demands a leader who can innovate and operate at scale, manage complex stakeholder relationships across Operations, Legal, Employee Relations, and PXT teams, and continuously innovate to expand the system's capabilities into new geographies and use cases. • Provide guidance and support for Security and Loss Prevention teams; supply chain, logistics and transportation operations and coordination groups, other stakeholders with the Amazon organization and third parties. • Deploy and implement risk assessment methodologies specifically cut to address current and foreseeable risks within the last mile environments, scenarios and use cases; methods to identify and implement the security strategies for last mile itineraries within the region, in accordance with risks assessment; and conducting security due diligence assessments on potential business partners such as wholesalers, third party logistics, delivery service providers (DSP), and other business-critical functions regionally • Implement key liaison contacts in industry, law enforcement, government and regulatory agencies to maintain awareness of and provide tactical response to upcoming legislation, industry trends, external risks and new technologies related to last mile operations • Ensure compliance to internal standards by means of supporting the Global Security Risk Compliance Audit team in defining the requirements for Last Mile (LM) Security; collaborate and provide expertise in conducting internal security audits; partner with appropriate stakeholders to implement effective audit programs to detect, prevent and resolve LM losses; implement and provide guidance for conducting audits to assess the Last Mile Security of business partners, vendors, third party logistics providers, and carriers in the areas of transportation, sortation, and delivery distribution; and follow up on definition and implementation of corrective action plans. • Implement internal business stakeholder support in order to promote security as added value and business differentiator; provide direct input to the relevant internal stakeholders and operational teams on high risk new business initiatives within the last mile environment; partner with appropriate internal stakeholders to provide security input regarding the selection of third party last mile providers (DSP); implement key collaborations with regional stakeholders to implement consistent standards, programs, assessments and procedures for the network with careful consideration for implementing and maintaining relationships with affiliate management and international partners • Contribute with expertise for the implementation of last mile Security awareness campaigns for general sensitization of personnel, and specific training packages for S&LP personnel, including, international, threat and risk assessment, risk management, loss prevention, intelligence and MO’s, incident management, and investigations • Contribute to reduce business losses on security incidents and related claims by identifying and understanding vulnerabilities, MO’s, and implementation the appropriate means and measures to protect transported assets in the last mile environments. Direct involvement in complex investigations at a high level. If required also act as the lead interface for wholesalers and third party providers. Implement strategies and programs which prevent theft, diversion and losses from the supply chain in partnership with internal and external stakeholders. Basic Qualifications: - 5+ years of security service, loss prevention, asset protection, investigations, or law enforcement, or 2+ years of Amazon (Blue Badge/FTE) experience - 3+ years of people management experience - 3+ years of implementing metric-based strategies utilizing continuous improvement concepts experience - Experience with MS Office Professional Suite and excellent working knowledge of MS Excel - Bachelor's degree or equivalent, or 5+ years of relevant professional or military experience Preferred Qualifications: - Experience using Microsoft Excel for data analysis, formulae, and data visualization Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Sr. SLP manager, Centralized Monitoring and Response System- CMRS at ADCI. Skills: Monitoring and Response, Loss Prevention, Incident Response, Process Compliance. Drive measurable financial impact. Assist field SLP investigations", "postedDate" : "2026-06-13T14:40:00.264", "createdAt" : "2026-06-13T14:40:00.264", "lastUpdated" : "2026-06-15T06:00:01.039", "ingestTimestamp" : "2026-06-13T14:40:00.264", "mongoId" : "6a2a660674d8ee00a062b8f7", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10443646/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "CCTV analysis", "Process compliance", "Metric-based strategies", "Continuous improvement", "Leadership", "Monitoring and Response", "Loss Prevention", "Incident Response", "Process Compliance", "Loss prevention", "Asset protection", "Investigations", "Process audit", "Risk assessment", "Security due diligence", "Business partner assessment", "Third party logistics", "Delivery service providers", "Security awareness", "Threat assessment", "Risk management", "Intelligence", "Incident management", "Supply chain security", "Continuous improvement concepts", "Security and Loss Prevention", "Supply chain", "Logistics", "Transportation", "Last Mile operations", "Middle Mile operations", "Fulfillment Centers", "Grocery & Specialty Fulfillment", "Centralized monitoring", "Incident response", "Process audit frameworks", "Loss prevention interventions", "Crisis response", "Operational process compliance", "Security operations", "Risk assessment methodologies", "Last mile itineraries", "Business partner due diligence", "Industry trends", "External risks", "New technologies", "Global Security Risk Compliance", "Business partner security", "Vendor security", "Carrier security", "Transportation security", "Sortation security", "Delivery security", "Corrective action plans", "High risk business initiatives", "Security awareness campaigns", "Threat and risk assessment", "Intelligence and MO's", "Security incidents", "Related claims", "Transported assets", "MS Office", "MS Excel" ], "skillCount" : 63, "jobCategory" : "marketing", "dataQualityScore" : 1.0, "_score" : 779.0348, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true }, { "id" : "6a305f40f292fd229cf7a1ea", "title" : "Sales Advisor - Hvaltorvet Senter (3-4 t/u)", "company" : "Rituals", "industry" : "Cosmetics", "salary" : { "min" : 275000.0, "max" : 345000.0, "currency" : "NOK", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "The estimation is based on the market baseline for an Entry-level Sales Advisor in Sandefjord, Norway, with adjustments for the retail industry and company size." }, "location" : "Sandefjord, Vestfold, NO", "locations" : [ "Sandefjord", "Vestfold", "NO" ], "timestamp" : "2026-06-16T11:13:20.024", "fingerprint" : "d6f4e231071b2d06b23aff4147edeab2927453c019d82664ef8c23c19d9855a0", "source" : "smartrecruiters", "language" : "no", "applyUrl" : "https://jobs.smartrecruiters.com/Rituals1/744000132212566-sales-advisor-hvaltorvet-senter-3-4-t-u-", "externalId" : "744000132212566", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Sandefjord", "state" : "Vestfold", "country" : "Norway", "continent" : "eu", "source" : "llm", "workMode" : "onsite", "geo" : "59.0799004,10.2804322" } ], "locationText" : "Sandefjord, Vestfold, Norway", "employmentType" : "FULL_TIME", "experienceMinYears" : 15, "experienceMaxYears" : 99, "experienceLevel" : "executive", "professionalSkills" : [ "Customer service", "Visual merchandising" ], "majorSkills" : "Customer experience, Sales technique", "majorSkillsList" : [ "Customer experience", "Sales technique" ], "coreResponsibilities" : "Guide customers to products, Collaborate with colleagues to reach goals, Engage customers and deliver customer experience, Maintain store cleanliness and tidiness, Present products according to guidelines, Follow safety routines", "teamCollaboration" : "Work with colleagues", "domainKnowledge" : "Product assortment; Sales technique", "domainList" : [ "product-assortment", "sales-technique" ], "domainSpecificKnowledge" : [ "Product assortment", "Sales technique" ], "continuousLearning" : "Global training programs", "problemSolvingSkills" : "Problem solving", "qualificationsBasic" : "Relevant experience in retail, customer service, or health, Decision-making ability, Problem-solving ability, Excellent Norwegian language skills, Excellent English language skills", "qualificationsPreferred" : "Organized, Structured", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "Som Rituals’ nye butikkselger brenner du for kundeopplevelsen og teamworket. Hver Rituals-kunde er unik. Med dine ferdigheter og kunnskaper veileder du hver kunde til riktige produkter for å møte deres behov. I tillegg til dette er du ansvarlig for å: * Ha et nært samarbeid med kollegene dine for å nå dine og butikkens mål. * Ta kontakt med kundene og levere en kundeopplevelse som er ‘Best in Class’. * Holde butikken ren og ryddig i henhold til selskapets standard, slik at produktene alltid presenteres i henhold til Rituals’ retningslinjer for visual merchandising. * Følge sikkerhetsrutinene i butikken. I gjengjeld får du muligheten til å vokse med oss og utvikle dine kunnskaper og ferdigheter innen detaljhandel gjennom våre globale opplæringsprogrammer der du lærer mer om vårt produktsortiment og vår salgsteknikk. ## Qualifications I butikken jobber du sammen med lidenskapelige og entusiastiske kolleger som virkelig jobber med Heart & Soul. Akkurat som deg brenner de for å skape en magisk kundeopplevelse. Du er one of a kind fordi du har evnen til å få genuin kontakt med kunder og få dem til å føle seg hjemme i våre butikker. Som Rituals-rådgiver er du også profesjonell og er en ambassadør for vårt merke. Du har også: * Relevant erfaring fra en lignende stilling innen detaljhandel, kundeservice eller helse. * Resultatorientert tankegang og er en lagspiller. * Evne til å ta beslutninger og løse problemer. * Øye for detaljer, er organisert og strukturert. * Meget gode språkkunnskaper i norsk og engelsk. ## Additional Information Er du interessert? Vi tilbyr en stilling på 3 timer/uke og en stilling på 4 timer/uke. Startdato: Etter avtale. Vi streber etter å være det raskest voksende velværemerket som bryr seg om deg like mye som vi bryr oss om miljøet. Bli en del av reisen vår. Er dette muligheten du har lett etter? Hvis du har spørsmål, vennligst kontakt vårt rekrutteringsteam; recruitment.nordics@rituals.com. Lykke til i rekrutteringsprosessen! I henhold til GDPR-lovgivning aksepterer Rituals kun søknader via vår karriereside.", "summaryDescription" : "Sales Advisor - Hvaltorvet Senter (3-4 t/u) at Rituals. Skills: Customer experience, Sales technique. Guide customers to products. Collaborate with colleagues to reach goals", "postedDate" : "2026-06-15T14:09:32.000", "createdAt" : "2026-06-16T00:16:06.143", "lastUpdated" : "2026-06-16T11:13:20.024", "ingestTimestamp" : "2026-06-16T00:16:06.143", "mongoId" : "6a305f40f292fd229cf7a1ea", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Customer experience", "Sales technique", "Customer service", "Visual merchandising", "Product assortment" ], "skillCount" : 5, "jobCategory" : "sales", "jobSubcategory" : "revenue", "seniorityLevel" : "Entry", "dataQualityScore" : 1.0, "_score" : 778.224, "daysOld" : 0, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Retail", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2c9def74d8ee00a099d1f0", "title" : "[8NW] Senior SecOps Incident Response Automation Engineer", "company" : "Software Mind", "industry" : "Information Technology And Services", "salary" : { "min" : 3.5E7, "max" : 5.5E7, "currency" : "CRC", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior SecOps Incident Response Automation Engineer in San José, Costa Rica, adjusted for the FinTech industry and senior experience level." }, "location" : "San José, San José Province, CR", "locations" : [ "San José", "San José Province", "CR" ], "timestamp" : "2026-06-15T08:56:26.782", "fingerprint" : "5ffd1f23307dc4070609d77ee63358d0b29af86091c01ca8cc6f41993be3c213", "source" : "smartrecruiters", "language" : "en", "applyUrl" : "https://jobs.smartrecruiters.com/SoftwareMind/744000131889661--8nw-senior-secops-incident-response-automation-engineer-", "externalId" : "744000131889661", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San José", "state" : "San José Province", "country" : "Costa Rica", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "9.9327707,-84.0796144" } ], "locationText" : "San José, San José Province, Costa Rica", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 10, "experienceLevel" : "mid", "technicalSkills" : "SOAR, SIEM, APIs, Python", "professionalSkills" : [ "Automation development", "Data retrieval", "Data manipulation", "Data reporting", "API integrations", "Data management", "Data presentation" ], "hardSkillsList" : [ "Incident response workflows", "Playbooks", "Automate manual processes", "Scripting for automation", "API connections" ], "softSkillsList" : [ "Negotiation" ], "hardSkills" : [ { "name" : "Incident response workflows", "level" : "intermediate" }, { "name" : "Playbooks", "level" : "intermediate" }, { "name" : "Automate manual processes", "level" : "intermediate" }, { "name" : "Scripting for automation", "level" : "intermediate" }, { "name" : "API connections", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Negotiation" } ], "majorSkills" : "Incident Response, Automation, SOAR, SIEM", "majorSkillsList" : [ "Incident Response", "Automation", "SOAR", "SIEM" ], "coreResponsibilities" : "Build and maintain SOAR automated response platform, Support AI-enabled response, Route escalations to on-call personnel, Build automated SOC response tools, Build automation programs, Build incident response workflows, Perform Security team tasks, Support on-call response team", "teamCollaboration" : "On-call response team; Technical stakeholders; Non-technical stakeholders", "domainKnowledge" : "Fintech industry; Regulated industry environment; SOC response; AI-enabled response; DLP design", "domainList" : [ "fintech-industry", "regulated-industry-environment", "soc-response", "ai-enabled-response", "dlp-design" ], "domainSpecificKnowledge" : [ "Fintech industry", "Regulated industry environment", "SOC response", "AI-enabled response", "DLP design" ], "toolProficiency" : [ "Torq", "Tines", "Google Sheets", "Excel" ], "communicationSkills" : "Communicate effectively", "continuousLearning" : "Desire and willingness to learn AI/LLM", "problemSolvingSkills" : "Identify problems; Assess problems; Tackle problems", "specialRequirements" : "On-call response, Off-hours support", "qualificationsBasic" : "Excellent English fluency, SOC response experience, Experience working as part of a lean team, Experience designing, implementing, and tuning SIEM and SOAR findings, Experience configuring advanced automations, Experience working with APIs, Experience with scripting for automation, Experience in data management, manipulation, and presentation", "qualificationsPreferred" : "Experience using Python for scripting, Experience with AI/LLM response automation, Experience with DLP design and tuning, Experience with Panther SIEM", "remoteFriendly" : true, "workSiteFlexibility" : "Flexible", "rawDescription" : "We are Software Mind, an awesome team of engineers who are ready to ramp up any top-notch company’s projects! Our aim? To always be one step ahead. Become part of a multicultural company in constant growth with an excellent work environment certified by Great Place To Work! Overview Software Mind is seeking qualified candidates located in Latam to fill the role of Sr. SecOps Incident Response Automation Engineer. In addition to a competitive salary rate and a positive work environment, committed to delivering high-quality technology solutions, we also offer: * Flexible schedules * An authentic work-life balance * Payment in US Dollars About the role: Our client develops digital experiences and platforms that provide consumers with information about financial services and financial products, to help them make the best financial decisions for their unique needs. We are looking for a Senior SecOps Incident Response Automation Engineer to support the client's new, greenfield projects, and build an incident response automation program using Torq (or similar SOAR tools), manage escalations, build incident response workflows, write playbooks, and automate a wide range of manual processes. The role is part of a new team and program being built from the ground up. The role provides plenty of autonomy, and the client is looking for someone who is a high driver who is biased to take action and able to identify, assess, and tackle problems that are sometimes ambiguous. They are looking for a proactive individual with great communication skills who enjoys taking on ownership of tasks and challenges. ## Qualifications Role Responsibilities: * Help build and maintain a new SOAR automated response platform using Torq, that supports AI-enabled response and escalations to be routed to on-call personnel at appropriate times. * Build automated SOC response tools, automation programs, incident response workflows, etc. * Perform various Security team tasks as needed. * Be available to support the on-call response team, occasionally on an “as needed” basis during off-hours to respond to potential security incidents. Required Skills & Qualities: * Communication and Negotiation - excellent English fluency/proficiency is required, and candidates must be able to communicate effectively to technical and non-technical stakeholders. * SOC response experience (ideally with experience in a fintech industry or another highly regulated industry environment) * Experience working as part of a lean team in a fast-paced technical environment or organization. * Experience designing, implementing, and tuning SIEM and SOAR findings, including experience configuring advanced automations with cutting-edge tools like Torq, Tines, or similar. * Experience in data retrieval, data manipulation, and data reporting, including the following skills: * Experience working with APIs (at a minimum, having a strong understanding of APIs, API integrations, the ability to set up API connections, and using APIs to access/retrieve data). * Experience with scripting for automation * Experience in data management, manipulation, and presentation (using data in Google Sheets, Excel, and databases). Control work areas: * 90% SOC/SIEM/SOAR automation development * 5% Join the on-call response team * 5% Other ## Additional Information Nice to have: * Experience using Python for scripting * Experience with AI/LLM response automation within the area of SOC response, or at minimum, a desire and willingness to learn * Experience with DLP design and tuning * Experience with Panther SIEM", "summaryDescription" : "[8NW] Senior SecOps Incident Response Automation Engineer at Software Mind. Skills: Incident Response, Automation, SOAR, SIEM. Build and maintain SOAR automated response platform. Support AI-enabled response", "postedDate" : "2026-06-12T12:31:33.000", "createdAt" : "2026-06-14T02:42:40.717", "lastUpdated" : "2026-06-15T08:56:26.782", "ingestTimestamp" : "2026-06-14T02:42:40.717", "mongoId" : "6a2c9def74d8ee00a099d1f0", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Incident response workflows", "Playbooks", "Automate manual processes", "Scripting for automation", "API connections", "Negotiation", "Incident Response", "Automation", "SOAR", "SIEM", "Automation development", "Data retrieval", "Data manipulation", "Data reporting", "API integrations", "Data management", "Data presentation", "Fintech industry", "Regulated industry environment", "SOC response", "AI-enabled response", "DLP design", "Torq", "Tines", "Google Sheets", "Excel" ], "skillCount" : 26, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Senior", "dataQualityScore" : 1.0, "_score" : 759.7886, "daysOld" : 2, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "FinTech", "llmIndustryConfidence" : 0.95 }, { "id" : "693072a470f0b99d58ffb666", "title" : "BBM Escalation Specialist, Amazon Maintenance Operation Centre", "company" : "ADCI HYD 16 SEZ - H83", "industry" : "Facilities, Maintenance, Real Estate, Real Estate/Facilities, fulfillment ops", "salary" : { "min" : 750000.0, "max" : 1200000.0, "currency" : "INR", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for an E-Commerce BBM Escalation Specialist in Hyderabad, India, adjusted for mid-seniority and company size." }, "location" : "Hyderabad, Telangana, IND", "locations" : [ "Hyderabad, Telangana, IND" ], "timestamp" : "2026-06-15T00:01:07.751", "fingerprint" : "d82fa053e4b986c0845c0de7a08be142c3bb0a853714c6a0d7c61185120d051a", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.com/jobs/3134871/apply", "externalId" : "c116fc68-a0dd-426c-8bda-0758fd0f8b7b", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Hyderabad", "state" : "Telangana", "country" : "India", "continent" : "as", "source" : "llm", "workMode" : "onsite", "geo" : "17.3605890,78.4740613" } ], "locationText" : "Hyderabad, Telangana, India", "employmentType" : "FULL_TIME", "minimumEducation" : "High school diploma or equivalent", "technicalSkills" : "Microsoft Office Suite", "professionalSkills" : [ "Facilities management", "Vendor management", "Technical support", "Work order management" ], "hardSkillsList" : [ "CMMS systems" ], "softSkillsList" : [ "Attention to detail" ], "hardSkills" : [ { "name" : "CMMS systems", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Attention to detail" } ], "majorSkills" : "Escalation management, Vendor dispatch coordination, Monitoring and response", "majorSkillsList" : [ "Escalation management", "Vendor dispatch coordination", "Monitoring and response" ], "coreResponsibilities" : "Respond to and triage incoming work requests, Manage remote works from start to end, Raise work orders/purchase orders, Receipt work orders/purchase orders, Communicate effectively with stakeholders, Provide updates on vendor status, Coordinate works during an escalation, Identify and escalate critical issues, Monitor refrigeration alarm systems, Respond to critical alerts, Manage and prioritize work queues, Coordinate with local vendors and maintenance teams, Execute emergency response procedures, Document all actions, Maintain accurate case records, Support continuous improvement initiatives", "teamCollaboration" : "Cross-functional teams", "domainKnowledge" : "Building maintenance systems; Refrigeration systems; Electrical systems; HVAC systems; Building automation systems", "domainList" : [ "building-maintenance-systems", "refrigeration-systems", "electrical-systems", "hvac-systems", "building-automation-systems" ], "domainSpecificKnowledge" : [ "Building maintenance systems", "Refrigeration systems", "Electrical systems", "HVAC systems", "Building automation systems" ], "toolProficiency" : [ "CMMS systems" ], "communicationSkills" : "Written communication; Verbal communication", "documentationSkills" : "Case records", "problemSolvingSkills" : "Problem-solving skills; Analytical skills", "specialRequirements" : "24/7 shift environment", "outcomesObjectives" : "Minimize operational impact; Ensure timely resolution of facility issues", "qualificationsBasic" : "High school diploma or equivalent, Experience in technical support, facilities management, or related field, Problem-solving and analytical skills, Excellent written and verbal communication abilities, Proficiency in Microsoft Office Suite, Experience with CMMS systems and work order management, Ability to work in a 24/7 shift environment, Customer service oriented with attention to detail", "qualificationsPreferred" : "Associate's degree in technical field or equivalent experience, Knowledge of building maintenance systems, Experience with vendor/contractor management, Multi-lingual capabilities, Previous experience in a command center or operations environment, Familiarity with building automation systems", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "We are seeking a dedicated Base Building Maintenance Escalation Specialist to join our Amazon Maintenance Operations Centre (AMOC) team. This role is essential in providing 24/7 monitoring and response for our global facility network, ensuring continuous operation through effective vendor management and technical support. The successful candidate will be responsible for first-line monitoring, vendor dispatch coordination, and escalation management across multiple Amazon business units. Key job responsibilities • Respond to and triage incoming work requests within standard service level agreements (SLAs) • Manage remote works from start to end, including work order/purchase order raising and receipting • Communicate effectively and efficiently with stakeholders (Reliability Maintenance Engineering, Ops, H&S etc.) • Provide updates on vendor status, take the lead on coordinating works during an escalation • Identify and escalate critical issues through appropriate channels to maintain equipment reliability and minimize operational impact • Monitor, respond to, and manage refrigeration alarm systems, ensuring timely response to critical alerts • Manage and prioritize work queues based on urgency and SLA requirements • Coordinate with local vendors and maintenance teams to ensure timely resolution of facility issues • Execute emergency response procedures during critical facility incidents • Document all actions and maintain accurate case records • Support continuous improvement initiatives for processes and procedures Basic Qualifications: - High school diploma or equivalent - Experience in technical support, facilities management, or related field - Strong problem-solving and analytical skills - Excellent written and verbal communication abilities - Proficiency in Microsoft Office Suite - Experience with CMMS systems and work order management - Ability to work in a 24/7 shift environment - Customer service oriented with strong attention to detail Preferred Qualifications: - Associate's degree in technical field or equivalent experience - Knowledge of building maintenance systems (HVAC, refrigeration, electrical) - Experience with vendor/contractor management - Multi-lingual capabilities - Previous experience in a command center or operations environment - Familiarity with building automation systems Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "BBM Escalation Specialist, Amazon Maintenance Operation Centre at ADCI HYD 16 SEZ - H83. Skills: Escalation management, Vendor dispatch coordination, Monitoring and response. Respond to and triage incoming work requests. Manage remote works from start to end", "postedDate" : "2026-06-13T00:37:08.480", "createdAt" : "2026-06-13T00:37:08.480", "lastUpdated" : "2026-06-15T00:01:07.751", "ingestTimestamp" : "2026-06-13T00:37:08.480", "mongoId" : "693072a470f0b99d58ffb666", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.com/jobs/3134871/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "CMMS systems", "Attention to detail", "Escalation management", "Vendor dispatch coordination", "Monitoring and response", "Facilities management", "Vendor management", "Technical support", "Work order management", "Building maintenance systems", "Refrigeration systems", "Electrical systems", "HVAC systems", "Building automation systems" ], "skillCount" : 14, "jobCategory" : "data", "dataQualityScore" : 0.8888889, "_score" : 744.3772, "daysOld" : 1, "hasLocation" : true, "hasGeo" : true }, { "id" : "6a2cad9574d8ee00a09d2f3b", "title" : "[8NW] Senior SecOps Incident Response Automation Engineer", "company" : "Software Mind", "industry" : "Information Technology And Services", "salary" : { "min" : 3.5E7, "max" : 5.5E7, "currency" : "CRC", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Senior SecOps Incident Response Automation Engineer in San José, Costa Rica, adjusted for the FinTech industry and senior experience level." }, "location" : "San José, San José Province, CR", "locations" : [ "San José", "San José Province", "CR" ], "timestamp" : "2026-06-15T03:27:45.906", "fingerprint" : "0cb0bc990483f2d39ebdbaccb952e4c66b52e0349a42e4cdb31c0335782d463f", "source" : "smartrecruiters", "language" : "en", "applyUrl" : "https://jobs.smartrecruiters.com/SoftwareMind/744000131889661--8nw-senior-secops-incident-response-automation-engineer-", "externalId" : "744000131889661", "industryFunction" : { }, "structuredLocations" : [ { "city" : "San José", "state" : "San José Province", "country" : "Costa Rica", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "9.9327707,-84.0796144" } ], "locationText" : "San José, San José Province, Costa Rica", "employmentType" : "FULL_TIME", "experienceMinYears" : 5, "experienceMaxYears" : 10, "experienceLevel" : "mid", "technicalSkills" : "SOAR, SIEM, APIs, Python", "professionalSkills" : [ "Automation development", "Incident response", "Data retrieval", "Data manipulation", "Data reporting", "Data presentation" ], "hardSkillsList" : [ "API integrations", "Scripting for automation", "Google Sheets", "Excel", "Databases" ], "softSkillsList" : [ "Negotiation" ], "hardSkills" : [ { "name" : "API integrations", "level" : "intermediate" }, { "name" : "Scripting for automation", "level" : "intermediate" }, { "name" : "Google Sheets", "level" : "intermediate" }, { "name" : "Excel", "level" : "intermediate" }, { "name" : "Databases", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Negotiation" } ], "majorSkills" : "Incident Response Automation, SOAR, SIEM, Automation Development", "majorSkillsList" : [ "Incident Response Automation", "SOAR", "SIEM", "Automation Development" ], "coreResponsibilities" : "Build SOAR platform, Maintain SOAR platform, Support AI-enabled response, Route escalations, Build automated SOC tools, Build automation programs, Build incident response workflows, Perform Security team tasks, Support on-call response team", "teamCollaboration" : "Technical stakeholders; Non-technical stakeholders; On-call response team", "domainKnowledge" : "Fintech industry; Regulated industry; SOC response; SIEM; SOAR; AI-enabled response; DLP design", "domainList" : [ "fintech-industry", "regulated-industry", "soc-response", "siem", "soar", "ai-enabled-response", "dlp-design" ], "domainSpecificKnowledge" : [ "Fintech industry", "Regulated industry", "SOC response", "SIEM", "SOAR", "AI-enabled response", "DLP design" ], "toolProficiency" : [ "Torq", "Tines", "Google Sheets", "Excel" ], "communicationSkills" : "English fluency; Communicate effectively", "continuousLearning" : "Learn AI/LLM automation", "problemSolvingSkills" : "Identify problems; Assess problems; Tackle problems", "specialRequirements" : "On-call response, Off-hours support", "qualificationsBasic" : "Excellent English fluency, SOC response experience, Experience with APIs, Experience with scripting, Experience in data management", "qualificationsPreferred" : "Experience in fintech industry, Experience in regulated industry, Experience with Python for scripting, Experience with AI/LLM response automation, Experience with DLP design, Experience with Panther SIEM", "remoteFriendly" : true, "workSiteFlexibility" : "Flexible", "rawDescription" : "We are Software Mind, an awesome team of engineers who are ready to ramp up any top-notch company’s projects! Our aim? To always be one step ahead. Become part of a multicultural company in constant growth with an excellent work environment certified by Great Place To Work! Overview Software Mind is seeking qualified candidates located in Latam to fill the role of Sr. SecOps Incident Response Automation Engineer. In addition to a competitive salary rate and a positive work environment, committed to delivering high-quality technology solutions, we also offer: * Flexible schedules * An authentic work-life balance * Payment in US Dollars About the role: Our client develops digital experiences and platforms that provide consumers with information about financial services and financial products, to help them make the best financial decisions for their unique needs. We are looking for a Senior SecOps Incident Response Automation Engineer to support the client's new, greenfield projects, and build an incident response automation program using Torq (or similar SOAR tools), manage escalations, build incident response workflows, write playbooks, and automate a wide range of manual processes. The role is part of a new team and program being built from the ground up. The role provides plenty of autonomy, and the client is looking for someone who is a high driver who is biased to take action and able to identify, assess, and tackle problems that are sometimes ambiguous. They are looking for a proactive individual with great communication skills who enjoys taking on ownership of tasks and challenges. ## Qualifications Role Responsibilities: * Help build and maintain a new SOAR automated response platform using Torq, that supports AI-enabled response and escalations to be routed to on-call personnel at appropriate times. * Build automated SOC response tools, automation programs, incident response workflows, etc. * Perform various Security team tasks as needed. * Be available to support the on-call response team, occasionally on an “as needed” basis during off-hours to respond to potential security incidents. Required Skills & Qualities: * Communication and Negotiation - excellent English fluency/proficiency is required, and candidates must be able to communicate effectively to technical and non-technical stakeholders. * SOC response experience (ideally with experience in a fintech industry or another highly regulated industry environment) * Experience working as part of a lean team in a fast-paced technical environment or organization. * Experience designing, implementing, and tuning SIEM and SOAR findings, including experience configuring advanced automations with cutting-edge tools like Torq, Tines, or similar. * Experience in data retrieval, data manipulation, and data reporting, including the following skills: * Experience working with APIs (at a minimum, having a strong understanding of APIs, API integrations, the ability to set up API connections, and using APIs to access/retrieve data). * Experience with scripting for automation * Experience in data management, manipulation, and presentation (using data in Google Sheets, Excel, and databases). Control work areas: * 90% SOC/SIEM/SOAR automation development * 5% Join the on-call response team * 5% Other ## Additional Information Nice to have: * Experience using Python for scripting * Experience with AI/LLM response automation within the area of SOC response, or at minimum, a desire and willingness to learn * Experience with DLP design and tuning * Experience with Panther SIEM", "summaryDescription" : "[8NW] Senior SecOps Incident Response Automation Engineer at Software Mind. Skills: Incident Response Automation, SOAR, SIEM, Automation Development. Build SOAR platform. Maintain SOAR platform", "postedDate" : "2026-06-12T12:31:33.000", "createdAt" : "2026-06-13T22:30:03.454", "lastUpdated" : "2026-06-15T03:27:45.906", "ingestTimestamp" : "2026-06-13T22:30:03.454", "mongoId" : "6a2cad9574d8ee00a09d2f3b", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "API integrations", "Scripting for automation", "Google Sheets", "Excel", "Databases", "Negotiation", "Incident Response Automation", "SOAR", "SIEM", "Automation Development", "Automation development", "Incident response", "Data retrieval", "Data manipulation", "Data reporting", "Data presentation", "Fintech industry", "Regulated industry", "SOC response", "AI-enabled response", "DLP design", "Torq", "Tines" ], "skillCount" : 23, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Senior", "dataQualityScore" : 1.0, "_score" : 721.4049, "daysOld" : 2, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "FinTech", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2cc3ad74d8ee00a0a0a191", "title" : "Incident Management Engineer", "company" : "Amazon Support Services Costa Rica SRL", "industry" : "Operations, IT, Support Engineering, Cloud Computing", "salary" : { "min" : 1.95E7, "max" : 2.75E7, "currency" : "CRC", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for an Incident Management Engineer in Heredia, Costa Rica, adjusted for mid-seniority and the technology industry." }, "location" : "Heredia, Heredia, CRI", "locations" : [ "Heredia, Heredia, CRI" ], "certifications" : [ "AWS Associate level certification", "AWS Professional level certification" ], "timestamp" : "2026-06-15T07:33:57.279", "fingerprint" : "2efc883689f886ec3ea0dd47efeb9ccbcb2b1c976c21f3df328656224fbf8452", "source" : "amazon", "language" : "en", "applyUrl" : "https://account.amazon.jobs/jobs/10446909/apply", "externalId" : "c91dec20-5c4d-403b-9ff4-bac59894cd85", "industryFunction" : { }, "structuredLocations" : [ { "city" : "Heredia", "state" : "Heredia", "country" : "Costa Rica", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "9.9984272,-84.1171215" } ], "locationText" : "Heredia, Heredia, Costa Rica", "employmentType" : "FULL_TIME", "minimumEducation" : "Bachelor's", "experienceMinYears" : 3, "experienceMaxYears" : 5, "experienceLevel" : "Mid", "technicalSkills" : "AWS", "professionalSkills" : [ "Incident management", "Account ownership", "Customer engagement", "Technical resolution" ], "hardSkillsList" : [ "Runbook development", "Response plan development" ], "softSkillsList" : [ "Leadership", "Mentoring" ], "hardSkills" : [ { "name" : "Runbook development", "level" : "intermediate" }, { "name" : "Response plan development", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Leadership" }, { "name" : "Mentoring" } ], "majorSkills" : "Incident Management, Incident Response, Customer Ownership", "majorSkillsList" : [ "Incident Management", "Incident Response", "Customer Ownership" ], "coreResponsibilities" : "Drive resolution of incidents, Provide incident response, Manage communications during events, Collaborate with stakeholders, Improve customer experience, Develop support mechanisms, Create standard operating procedures, Review standard operating procedures, Identify platform issues, Troubleshoot platform issues, Own improvement projects, Mentor peers", "teamCollaboration" : "Collaboration with Engineering Teams; Leading calls with participants; Key stakeholders across AWS", "domainKnowledge" : "Mission critical applications; Distributed architectures; Service-oriented architectures", "domainList" : [ "mission-critical-applications", "distributed-architectures", "service-oriented-architectures" ], "domainSpecificKnowledge" : [ "Mission critical applications", "Distributed architectures", "Service-oriented architectures" ], "communicationSkills" : "Written communication; Verbal communication; Presentation skills", "documentationSkills" : "Create design; Review design", "problemSolvingSkills" : "Technical troubleshooting", "specialRequirements" : "Work some weekends, Work public holidays", "outcomesObjectives" : "Reduce potential for failure; Accelerate recovery of workloads", "qualificationsBasic" : "3+ years systems engineering, 3+ years technical support, 3+ years Major Incident/Problem Management, Portuguese & English communication skills", "qualificationsPreferred" : "AWS Associate level certification, AWS Professional level certification, Knowledge of Lean methodologies, Knowledge of distributed architectures, Knowledge of service-oriented architectures, Review complex technical details, Convey key details to stakeholders", "remoteFriendly" : false, "workSiteFlexibility" : "Onsite", "rawDescription" : "The AWS Incident Detection and Response team is part of the ASPIRE organization within AWS Support, and is dedicated to offering eligible AWS Enterprise Support customers proactive engagement and incident management to reduce the potential for failure and to accelerate recovery of critical workloads from disruption. We achieve these objectives by working closely with customers to develop runbooks and response plans customized to the context of each workload onboarded to the service. Onboarded workloads are monitored 24x7 by a team of Incident Management Engineers (IMEs) to detect and engage customers on a call bridge within 5 minutes of a critical alarm. AWS Support is looking for a leader with a strong background in Incident Management and customer ownership to be there during the moments that matter for our most critical customers. We are looking for an Incident Management Engineer to join our team to provide incident response and account ownership. In this position, you will play a pivotal role in providing communication, emergency response, technical resolver engagement and incident management for our customers. This is a global role that requires excellent written and verbal communication skills and a passion and desire for leading the resolution of critical incidents. Your decisions are not only fundamental to helping protect our most critical customers but will help maintain the health of AWS customers worldwide. Please note as a follow-the-sun organization. Successful applicants will be required to work some weekends (Sunday to Thursday, or Tuesday to Saturday), and public holidays. Key job responsibilities - Drive the resolution of large scale customer impacting incidents or escalations in situations that are sometimes technically challenging in collaboration with Engineering Teams. - Provide critical incident response/management (including leading calls with internal/external participants) for customer’s critical workloads - Monitor and manage communications during high impact events via relevant channels - Collaborate with key stakeholders across AWS to improve the customer experience and develop mechanisms that support operational excellence - Create and review documentation; design/influence new standard operating procedures - Identify and troubleshoot recurring platform issues and own projects to drive improvements - Mentor peers in your areas of technical and operational strength About the team Diverse Experiences AWS values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn’t followed a traditional path, or includes alternative experiences, don’t let it stop you from applying. Why AWS? Amazon Web Services (AWS) is the world’s most comprehensive and broadly adopted cloud platform. We pioneered cloud computing and never stopped innovating — that’s why customers from the most successful startups to Global 500 companies trust our robust suite of products and services to power their businesses. Inclusive Team Culture Here at AWS, it’s in our nature to learn and be curious. Our employee-led affinity groups foster a culture of inclusion that empower us to be proud of our differences. Ongoing events and learning experiences, including our Conversations on Race and Ethnicity (CORE) and AmazeCon (gender diversity) conferences, inspire us to never stop embracing our uniqueness. Mentorship & Career Growth We’re continuously raising our performance bar as we strive to become Earth’s Best Employer. That’s why you’ll find endless knowledge-sharing, mentorship and other career-advancing resources here to help you develop into a better-rounded professional. Work/Life Balance We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture. When we feel supported in the workplace and at home, there’s nothing we can’t achieve in the cloud. Basic Qualifications: - Experience in communication and presentation skills, both written and verbal in Portuguese & English - 3+ years of systems engineering, or 3+ years of technical support experience - Bachelor's degree in a relevant field or equivalent work experience - 3+ years demonstrable Major Incident/Problem Management Experience for organizations that run mission critical applications Preferred Qualifications: - AWS Associate level certification, or AWS Professional level certification - Knowledge of Lean methodologies - Knowledge of distributed and service-oriented architectures - Ability to review complex technical details regarding ongoing issues/events and convey the key details to senior stakeholders to facilitate real-time decision making Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.", "summaryDescription" : "Incident Management Engineer at Amazon Support Services Costa Rica SRL. Skills: Incident Management, Incident Response, Customer Ownership. Drive resolution of incidents. Provide incident response", "postedDate" : "2026-06-11T00:00:00.000", "createdAt" : "2026-06-13T21:53:16.550", "lastUpdated" : "2026-06-15T07:33:57.279", "ingestTimestamp" : "2026-06-13T21:53:16.550", "mongoId" : "6a2cc3ad74d8ee00a0a0a191", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "sourceUrl" : "https://account.amazon.jobs/jobs/10446909/apply", "salaryBand" : "200k+", "hasSalary" : false, "allSkills" : [ "Runbook development", "Response plan development", "Leadership", "Mentoring", "Incident Management", "Incident Response", "Customer Ownership", "Incident management", "Account ownership", "Customer engagement", "Technical resolution", "Mission critical applications", "Distributed architectures", "Service-oriented architectures", "AWS Associate level certification", "AWS Professional level certification" ], "skillCount" : 16, "jobCategory" : "engineering", "jobSubcategory" : "software", "seniorityLevel" : "Mid", "dataQualityScore" : 1.0, "_score" : 718.8548, "daysOld" : 4, "hasLocation" : true, "hasGeo" : true, "llmIndustry" : "Technology", "llmIndustryConfidence" : 0.95 }, { "id" : "6a2a3f0f74d8ee00a05c04d2", "title" : "Agent, Critical Incident Response Team", "company" : "DoorDash", "salary" : { "min" : 115000.0, "max" : 165000.0, "currency" : "USD", "frequency" : "yearly", "is_estimated" : true, "estimation_basis" : "Market baseline for a Mid-level Agent, Critical Incident Response Team at a technology company in San Francisco, adjusted for company size and industry." }, "location" : "San Francisco", "locations" : [ "San Francisco" ], "timestamp" : "2026-06-11T07:49:47.201", "fingerprint" : "8eb2dae2fbc69cff4875d2a1648449fe33cc9849b32e52b81354371fd828292b", "source" : "greenhouse", "language" : "en", "applyUrl" : "https://job-boards.greenhouse.io/doordashusa/jobs/7998230", "externalId" : "7998230", "structuredLocations" : [ { "city" : "San Francisco", "state" : "California", "country" : "United States", "continent" : "na", "source" : "llm", "workMode" : "onsite", "geo" : "37.7879363,-122.4075201" } ], "locationText" : "San Francisco, California, United States", "minimumEducation" : "Bachelor's", "professionalSkills" : [ "Incident response", "Risk management" ], "hardSkillsList" : [ "Real-time monitoring", "Triage", "Response coordination" ], "softSkillsList" : [ "Critical thinking" ], "hardSkills" : [ { "name" : "Real-time monitoring", "level" : "intermediate" }, { "name" : "Triage", "level" : "intermediate" }, { "name" : "Response coordination", "level" : "intermediate" } ], "softSkills" : [ { "name" : "Critical thinking" } ], "majorSkills" : "Incident response, Risk management", "majorSkillsList" : [ "Incident response", "Risk management" ], "coreResponsibilities" : "Monitor and triage incidents, Respond to incidents, Analyze alerts, Coordinate response actions, Escalate issues", "teamCollaboration" : "Cross-functional teams", "domainKnowledge" : "Global safety and security; Emergency management; Criminal justice; Homeland security", "domainList" : [ "global-safety-and-security", "emergency-management", "criminal-justice", "homeland-security" ], "domainSpecificKnowledge" : [ "Global safety and security", "Emergency management", "Criminal justice", "Homeland security" ], "communicationSkills" : "Relationship building", "problemSolvingSkills" : "Decision making", "qualificationsBasic" : "Bachelor's degree or equivalent work experience, Experience in a relevant field", "qualificationsPreferred" : "Additional language skills (Spanish, French, or Mandarin) a plus", "workSiteFlexibility" : "Onsite", "rawDescription" : "About the Team The Global Safety and Security team advances DoorDash through the protection of people, property, operations, brand, and reputation. We manage safety and security risk and provide value across the business through technology, and a people-first approach. Our team strives to always be in front and there for our people anytime, anywhere. About the Role The Physical Security Agent, Critical Incident Response Team (CIRT) is responsible for real-time monitoring, triage, and response to incidents that impact DoorDash’s global workforce, assets, and operations. You’ll serve as a front-line responder, analyzing alerts, coordinating response actions, and escalating issues according to established Global Safety additional language skills (Spanish, French, or Mandarin) a plus Bachelor’s degree or equivalent work experience in a relevant field (e.g., emergency management, criminal justice, homeland security) Great communication and relationship building skills You’ll Love This Role If You thrive in high-tempo, real-time environments where every second matters You find purpose in helping protect people and operations from emerging risks You enjoy staying calm under pressure and making smart, quick decisions You value teamwork, precision, and continuous improvement Notice to Applicants for Jobs Located in NYC or Remote Jobs Associated With Office in NYC Only We use Covey as part of our hiring and/or promotional process for jobs in NYC and certain features may qualify it as an AEDT in NYC. As part of the hiring and/or promotion process, we provide Covey with job requirements and candidate submitted applications. We began using Covey Scout for Inbound from August 21, 2023, through December 21, 2023, and resumed using Covey Scout for Inbound again on June 29, 2024. The Covey tool has been reviewed by an independent auditor. Results of the audit may be viewed here: Covey Compensation Actual compensation within the pay range listed below will be decided based on factors including, but not limited to, skills, prior relevant experience, and specific work location. Base salary is localized according to employee work location. DoorDash cares about you and your overall well-being. That’s why we offer a comprehensive benefits package to all regular employees, which includes a 401(k) plan with employer matching, 16 weeks of paid parental leave, wellness benefits, commuter benefits match, paid time off and paid sick leave in compliance with applicable laws (e. g. Colorado Healthy Families and Workplaces Act). DoorDash also offers medical, dental, and vision benefits, 11 paid holidays, disability and basic life insurance, family-forming assistance, and a mental health program, among others. To learn more about our benefits, visit our careers page here. See below for paid time off details: For salaried roles: flexible paid time off/vacation, plus 80 hours of paid sick time per year. For hourly roles: vacation accrued at about 1 hour for every 25.97 hours worked (e. g. about 6.7 hours/month if working 40 hours/week; about 3.4 hours/month if working 20 hours/week), and paid sick time accrued at 1 hour for every 30 hours worked (e. g. about 5.8 hours/month if working 40 hours/week; about 2.9 hours/month if working 20 hours/week). The national base pay range for this position within the United States, including Illinois and Colorado. $27.90—$41 USD About DoorDash At DoorDash, our mission to empower local economies shapes how our team members move quickly, learn, and reiterate in order to make impactful decisions that display empathy for our range of users—from Dashers to merchant partners to consumers. We are a technology and logistics company that started by enabling door-to-door delivery, and we are looking for team members who can help us go from a company that is known as the place you order food to a company that people turn to for any and all goods. DoorDash is growing rapidly and changing constantly, which gives our team members the opportunity to share their unique perspectives, solve new challenges, and own their careers. We're committed to supporting employees’ happiness, healthiness, and overall well-being by providing comprehensive benefits and perks including premium healthcare, wellness expense reimbursement, paid parental leave and more. Our Commitment to Diversity and Inclusion We’re committed to growing and empowering a more inclusive community within our company, industry, and cities. That’s why we hire and cultivate diverse teams of people from all backgrounds, experiences, and perspectives. We believe that true innovation happens when everyone has room at the table and the tools, resources, and opportunity to excel. Statement of Non-Discrimination: In keeping with our beliefs and goals, no employee or applicant will face discrimination or harassment based on: race, color, ancestry, national origin, religion, age, gender, marital/domestic partner status, sexual orientation, gender identity or expression, disability status, or veteran status. Above and beyond discrimination and harassment based on “protected categories,” we also strive to prevent other subtler forms of inappropriate behavior (i.e., stereotyping) from ever gaining a foothold in our office. Whether blatant or hidden, barriers to success have no place at DoorDash. We value a diverse workforce – people who identify as women, non-binary or gender non-conforming, LGBTQIA+, American Indian or Native Alaskan, Black or African American, Hispanic or Latinx, Native Hawaiian or Other Pacific Islander, differently-abled, caretakers and parents, and veterans are strongly encouraged to apply. Thank you to the Level Playing Field Institute for this statement of non-discrimination. Pursuant to the San Francisco Fair Chance Ordinance, Los Angeles Fair Chance Initiative for Hiring Ordinance, and any other state or local hiring regulations, we will consider for employment any qualified applicant, including those with arrest and conviction records, in a manner consistent with the applicable regulation. If you need any accommodations, please inform your recruiting contact upon initial connection. Notice to Applicants for Jobs Located in NYC or Remote Jobs Associated With Office in NYC Only We used Covey as part of our hiring and/or promotional process for jobs in NYC and certain features may qualify it as an AEDT in NYC. As part of the hiring and/or promotion process, we provided Covey with job requirements and candidate submitted applications. We began using Covey Scout for Inbound from August 21, 2023, through December 21, 2023. We resumed using Covey Scout for Inbound again on June 29, 2024, and ceased using Covey Scout for Inbound on April 30, 2026. The Covey tool has been reviewed by an independent auditor. Results of the audit may be viewed here: https://getcovey.com/nyc-local-law-144.", "summaryDescription" : "Agent, Critical Incident Response Team at DoorDash. Skills: Incident response, Risk management. Monitor and triage incidents. Respond to incidents", "postedDate" : "2026-06-11T07:12:09.273", "createdAt" : "2026-06-11T07:12:09.273", "lastUpdated" : "2026-06-11T07:49:47.201", "ingestTimestamp" : "2026-06-11T07:12:09.273", "mongoId" : "6a2a3f0f74d8ee00a05c04d2", "processingStatus" : "llm_updated", "llmProcessingStatus" : true, "salaryAnnualMin" : 115000, "salaryAnnualMax" : 165000, "salaryBand" : "100k-150k", "hasSalary" : true, "allSkills" : [ "Real-time monitoring", "Triage", "Response coordination", "Critical thinking", "Incident response", "Risk management", "Global safety and security", "Emergency management", "Criminal justice", "Homeland security" ], "skillCount" : 10, "jobCategory" : "other", "jobSubcategory" : "244-global-safety-and-security", "dataQualityScore" : 0.7777778, "_score" : 718.31085, "daysOld" : 0, "hasLocation" : true, "hasGeo" : true } ], "status" : 200, "message" : "OK", "pagination" : { "page" : 0, "limit" : 50, "totalCount" : 124326, "totalPages" : 2487, "hasNext" : true, "hasPrevious" : false } }

Tier 3 4 Escalation Incident Response And Problem Management Jobs in New York

Incident and Escalation Manager

Security Incident Response Manager

Incident Response Lead

Project Manager, Incident Response

Incident Management Engineer (Spanish/English bilingual), Incident Detection and Response

Project Manager (Incident Response)

Tier 3, Engineer 4 – Network Solutions Engineer

Security Operations and Incident Response Manager

Incident Management Engineer (Portuguese/English bilingual), Incident Detection and Response

Cyber Incident Response Team - Tier 2 Shift Lead

Incident Management Engineer, Incident Detection and Response

Multi-lingual Escalation Specialist, Global Security Operations Center

Incident & Problem Manager

[8NW] Senior SecOps Incident Response Automation Engineer

[8NW] Senior SecOps Incident Response Automation Engineer

Security Engineer II, Security Incident Response Team (SIRT)

Assistant Manager, Cybersecurity Incident Response

Lead, Incidents & Escalations, User Operations

Lead, Incidents & Escalations, User Operations

Customer Incident Response Program Manager

Senior Incident Response Specialist, Cyber Security

Incident Detection/Response Manager (SOC Manager)

Support Engineer - Escalation Management

Manager, AV Incident Management

Support Engineer - Escalation Management

Senior Security Incident Response Engineer

Security Incident Response Lead

Manager, IT Incident & Problem Management

Security Engineer, Incident Response, CorpSec

Escalation Specialist

AWS Security Operations/Incident Response Engineer

Security Engineer, Detection and Response

Associate Customer Incident Responder, AWS Customer Incident Response Team (CIRT)

Senior Incident Response Engineer, Devices & Services Security

Security Engineer, AWS Security Incident Response

Tier 3 Support Engineer

Senior Security Engineer, AWS Security Incident Response

Incident Commander, Program Manager

AWS Security Operations/Incident Response Engineer

Multi-lingual Escalation Specialist, Global Security Operations Center

BBM Escalation Specialist, Amazon Maintenance Operation Centre

Service Integration & Management - Problem Management

Security Engineer, Detection and Response

Sr. SLP manager, Centralized Monitoring and Response System- CMRS

Sales Advisor - Hvaltorvet Senter (3-4 t/u)

[8NW] Senior SecOps Incident Response Automation Engineer

BBM Escalation Specialist, Amazon Maintenance Operation Centre

[8NW] Senior SecOps Incident Response Automation Engineer

Incident Management Engineer

Agent, Critical Incident Response Team

Common Questions