Incident Management Lead, Data Center Security

About the role

The Lead for Crisis and Incident Management will build a comprehensive program to manage crises and incidents at data center campuses worldwide. The role involves:

• Defining incident definitions and severity levels with partners.
• Bringing partners into agreement on definitions and procedures.
• Adopting the framework through playbooks, training, and exercises.
• Building metrics and reporting to measure performance.
• Holding vendors to consistent standards and enforcing performance.
• Managing major incidents, including activation, coordination, and stand-down.
• Running after-action reviews and feeding lessons learned back into the program.
• Designing and running a 24/7 monitoring and response capability through managed services.

Responsibilities

Key responsibilities include:

• Building and owning the global crisis and incident management program.
• Defining incident definitions and severity levels with partners.
• Bringing partners into agreement on definitions and procedures.
• Driving adoption of the framework through playbooks, training, and exercises.
• Defining incident metrics and building the reporting behind them.
• Ensuring vendor and managed service consistency.
• Managing major incidents end-to-end, including activation, coordination, and stand-down.
• Running structured after-action reviews and feeding lessons learned back into the program.
• Designing and running a 24/7 monitoring and response capability through managed services.

Requirements

Minimum qualifications include:

• Experience building or substantially rebuilding an incident management or crisis management program.
• Experience bringing partners you don't control into agreeing on definitions and procedures.
• Experience driving adoption of a framework from paper into playbooks, training, and exercises.
• Experience defining incident metrics and building the reporting behind them.
• Experience working physical security in or around data center or comparable critical-infrastructure operations.
• Experience running major incidents end-to-end.
• Experience holding vendors or managed services to defined performance standards.
• Ability to make the severity call quickly on incomplete information.

Qualifications

Preferred qualifications include:

• Experience designing incident taxonomies, severity models, or escalation frameworks that were adopted across multiple organizations or vendors.
• Experience running an incident metrics program at scale.
• Experience in incident command system (ICS/NIMS or comparable).
• Experience standing up or running a global security operations center (GSOC) or equivalent 24/7 capability.
• Certifications such as CPP, PSP, CEM, CBCP, or similar.
• Experience in regulated or high-assurance environments.