We are seeking a seasoned Blue Team leader to spearhead the evolution of our North American incident response program. This is a high-visibility, technical leadership role designed for an expert who excels in high-pressure situations and wants to define the response strategy for a scaling, cloud-native enterprise. You will act as the senior technical authority for major security events, bridging the gap between our 24/7 monitoring partners and internal engineering, infrastructure, and executive stakeholders.

Key Responsibilities:

• Incident Command: Serve as the primary Incident Commander for high-severity events in the U.S. region, directing containment strategies and cross-functional response efforts through to resolution
• Executive Communication: Translate complex technical risks into clear, actionable updates for senior business leadership
• Advanced Forensics: Lead deep-dive investigations across a modern stack, including multi-cloud environments, SaaS platforms, identity providers, and hybrid infrastructure
• Strategic Leadership: Provide technical mentorship to a regional team of responders while collaborating with international counterparts to ensure global operational consistency
• Readiness & Validation: Own the development of response playbooks (Ransomware, Data Exfiltration, Identity Theft) and lead tabletop exercises to stress-test our collective response “muscle memory-
• Next-Gen Operations: Partner with Security Engineering to integrate AI-assisted workflows and automated orchestration (SOAR) into the live response lifecycle
• Continuous Improvement: Manage post-mortem processes to identify systemic gaps, influencing future budget and tooling investments