Incident Response Commander

About the role

Incident Response Commanders lead the investigation and remediation of cyber security incidents, ensuring that threats are contained and business operations restored. Reporting to the Incident Response Manager, they coordinate technical and business teams to maintain the organization’s security posture.

Key responsibilities

• Maintain and continuously improve the Incident Response Plan (IRP) and related playbooks.
• Collaborate with legal, communications, and other departments to align processes.
• Document lessons learned, provide improvement recommendations and link related incidents.
• Act as Incident Commander during security events, assess severity, declare major incidents and drive response according to the IRP.
• Coordinate forensic activities, prioritize mitigation and recovery actions.
• Communicate status, notifications and reports to stakeholders and auditors.
• Participate in Cyber Defense Center collaboration, projects, and compliance initiatives related to CERT functions.

Required profile

• Relevant cybersecurity certifications (e.g., GCFACI, HCISSP, CEH, CISA, ITIL Foundation).
• STEM or cybersecurity academic background.
• 5+ years of experience in CERT, SOC, SecOps or GRC roles.
• Proven ability to stay calm under pressure and make clear decisions.
• Strong knowledge of incident management frameworks (ISO 27035, NIST, SANS 6‑step).
• Excellent communication skills for executive audiences.
• Experience in transportation, shipping or logistics is a plus.

Required skills

• GCFACI certification
• HCISSP certification
• CEH certification
• CISA certification
• ITIL Foundation certification
• Security Operations Center (SOC) techniques
• Forensic analysis techniques
• Incident response frameworks: ISO 27035, NIST, SANS 6‑step