Incident Management Lead, Data Center Security

About the role

The Lead for Crisis and Incident Management will build a comprehensive program to manage crises and incidents at data center campuses worldwide. The role involves defining incident definitions and severity levels, ensuring partner buy-in and governance, driving adoption, measuring performance, and managing major incidents.

Responsibilities

• Define incident definitions and severity levels, including thresholds and escalation criteria, with partners.
• Bring partners into agreement on definitions and procedures, and establish governance to keep the framework current as the fleet grows.
• Turn the framework into playbooks, training, and exercises to ensure responders know the right response and the escalation chain is tested.
• Define incident metrics and build reporting to measure performance and provide executive summaries.
• Ensure vendor and managed service consistency through common definitions, procedures, and reporting formats, with performance measured and enforced.
• Run the crisis process during major incidents, including activation, coordination, leadership communication, stand-down, and after-action review.
• Shape a 24/7 monitoring and response capability through GSOC-type managed services and site vendors, achieving continuous coverage without building a large in-house shift operation.

Requirements

• Experience building or substantially rebuilding an incident management or crisis management program, including defining incident definitions and severity models.
• Experience bringing partners you don't control into agreeing on definitions and procedures, and driving adoption.
• Experience defining incident metrics and building reporting, and holding vendors or managed services to defined performance standards.
• Knowledge of data center operations and experience running major incidents end-to-end.
• Experience in regulated or high-assurance environments, and familiarity with ICS/NIMS or similar incident command systems.

Qualifications

• Bachelor’s degree or equivalent in a field relevant to the role.
• Experience in physical security in or around data center or comparable critical-infrastructure operations.
• Experience in crisis management, including incident command system experience (ICS/NIMS or comparable).
• Experience in running a global security operations center (GSOC) or equivalent 24/7 capability.
• Certifications such as CPP, PSP, CEM, CBCP, or similar.
• Experience in hyperscalers, major colocation, or critical-infrastructure operators.
• Experience in business continuity or emergency management programs.

Benefits

Continuous coverage through GSOC-type managed services and site vendors, 24/7 monitoring and response capability, and a 25% minimum office presence requirement.

Pay

$290,000—$365,000 USD annually

Schedule

Hybrid policy with a minimum of 25% office presence required.