{"id":2717612,"url":"https://alion.io/job/amazon-incident-response-manager-security-operations-group-worldwide-operations-security","title":"Incident Response Manager, Security Operations Group | Worldwide Operations Security","company":{"id":19,"name":"Amazon","domain":"amazon.com","url":"https://alion.io/company/amazon","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Career site","truth_index":{"grade":"B","score":78,"open_postings":4570,"ghost_share":0,"stale_share":0.889,"repost_share":0.003,"time_to_fill_p50_days":30,"computed_at":"2026-11-10T06:52:35Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Incident Management","optional":false},{"name":"Microsoft Excel","optional":false},{"name":"Microsoft Office","optional":false},{"name":"Slack","optional":false}],"status":"live","first_seen_at":"2026-08-10T00:00:00Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-11-11T01:25:45Z","board_verified":true,"closed_at":null,"days_open":93,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":92},"description":"As an Incident Response Manager within Worldwide Operations Security (WWOS) Security Operations Group (SOG), you will serve as the primary crisis response coordinator for high and moderate severity incidents (SEV1, SEV2 and SEV3) impacting Amazon's people, operations, assets, and brand across globally. You will independently own the end-to-end lifecycle of critical incidents from initial notification and triage though immediate mitigation, stakeholder coordination, and post-incident review. Reporting to the Sr. Manager - Operations Incident Management, you will operate within established GSOC and SOG protocols, lead Incident Management Teams (IMTs) through complex crisis events, and drive continuous improvement of response frameworks across one of Amazon's most dynamic operating environments.\nKey job responsibilities\n- Lead end-to-end coordination of high severity incidents (SEV1/SEV2), managing the full lifecycle from initial notification through mitigation, stabilization, and closure\n- Own 24/7/365 on-call rotation, responding to threats and incidents within the CTI Matrix per SOG escalation procedures, including Slack channel activation and senior leadership notification\n- Coordinate Immediate Mitigation calls with site-level Incident Commanders and IMTs, assigning action items to ensure life safety, operational continuity, and brand protection\n- Execute tactical response protocols including video lockdown, ESU/Off-Duty deployments, and OSINT/SOCMINT analysis within established timelines\n- Prepare site risk overviews and deliver incident summaries to WWOS senior leadership within 4 hours of incident onset\n- Manage Incident Room operations including real-time updates, dynamic action tracking, EMT notifications, and stakeholder conference calls\n- Lead After Action Reviews within 3 days of incident conclusion, driving corrective actions and mechanism implementation to prevent recurrence\n- Maintain and validate high severity protocols, the CTI Matrix, escalation workflows, and response timelines through continuous improvement\n- Partner with GSOC, Regional S&LP, Operations, WHS, and PXT to influence decision-making and ensure site-level IMT readiness per WWOS Critical Incident Response standards\nA day in the life\nAs an Incident Response Manager, your day begins by reviewing active Incident Rooms, monitoring the GSOC threat landscape, and independently assessing emerging threats against the Category, Type, and Item (CTI) matrix to determine escalation requirements. You drive strategic and tactical work simultaneously, supporting Immediate Mitigation (IM) calls with site-level Incident Commanders and IMTs, and leading real-time response actions. Throughout the week, you engage senior stakeholders across WWOS, Ops, PXT, ER, WHS, and Ops Disruption leadership, supporting GSOC Conference Calls and guiding decision-making during critical incidents. You own On-Call rotation responsibilities, responding to emerging threats with direct mitigation support including coordinating ESU/Off-Duty deployments, conducting OSINT/SOCMINT analysis, and delivering initial incident summaries to WWOS senior leadership within established SLAs. When high severity events arise, you exercise independent judgment to create site-specific Slack channels, manage video lockdown tickets, prepare site risk overviews and hardening posture assessments, and lead After Action Reviews (AARs) within 3 days of incident conclusion. \nAbout the team\nThe Operational Incident Response (OIR) team sits within the Security Operations Group (SOG) under Worldwide Operations Security (WWOS). The team provides 24/7/365 critical incident coordination across WWAS operations, serving as the central point for real-time response to life safety events, operational disruptions, natural disasters, workplace violence, and facility security threats. Working through the GSOC, the team brings together key stakeholders, manages Incident Rooms, and drives resolution from first notification through post-incident review.\nOIR members are senior individual contributors who independently own the full incident lifecycle. They coordinate Immediate Mitigation calls with site-level Incident Commanders and IMTs, facilitate GSOC Conference Calls for SEV1 events, and deliver incident summaries to WWOS senior leadership. Key partnerships include GSOC, Regional S&LP, Operations leadership, Legal, and cross-functional business continuity stakeholders across highly diversified global environments.\nThe team operates as a service to the business, ensuring continuation of operations through risk oversight, contingency planning, and structured response. This role requires independent judgment under pressure, real-time coordination across multiple time zones, and the ability to influence senior leadership during unfolding events where life safety is at stake.\nBasic qualifications\n- 5+ years of high-volume, high-intensity environment such as a security operations center, event security, call center, or crisis management/emergency response center experience\n- Experience applying key financial performance indicators (KPIs) to analyses, or experience in building financial and operational reports/data sets that inform business decision-making\n- Experience building cross-functional partnerships and influencing stakeholders across the organization to act without having a direct reporting relationship\n- Knowledge of Microsoft Office products and applications (esp. MS Excel, Word) at an advanced level\n- Experience prioritizing and handling multiple assignments at any given time while maintaining commitment to deadlines, or experience with end-to-end project management\n- Experience in written and verbal communication with the ability to present complex technical information in a clear and concise manner to executives and non-technical leaders\n- Bachelor's degree or equivalent in Risk Management, Business Administration, Security Management, or a related field\nPreferred qualifications\n- Experience delivering results for large, cross-functional initiatives/projects, or experience working in a fast-paced and ambiguous environment\n- Master's degree in risk management, Security, Business Administration, or related field\n- A security/risk management industry certification (ASIS CPP, CRMP, CBCP, or equivalent)\n- Advanced experience with risk, business continuity, and data management platforms (BSI, Audit Board, etc.)\n- Direct user experience with geo-spatial tools and platforms (ArcGIS, ESRI, Palantir, etc.)\nOur inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit https://amazon.jobs/content/en/how-we-hire/accommodations for more information. If the country/region you’re applying in isn’t listed, please contact your Recruiting Partner.","description_format":"text","description_chars":6978,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":true},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Robotics AI","Advertising","Logistics & Warehouse Robotics"],"lifecycle":[{"event":"open","at":"2026-10-16T14:01:19Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.293,"p_room":0.28,"age_days":92,"expected_fill_days":30,"reasons":["conf:2","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-11-10T06:52:35Z"},"pay":null,"html_url":"https://alion.io/job/amazon-incident-response-manager-security-operations-group-worldwide-operations-security","json_url":"https://alion.io/job/amazon-incident-response-manager-security-operations-group-worldwide-operations-security.json","meta":{"generated_at":"2026-11-11T02:21:33Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":290,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":19},"rest":"https://alion.io/mcp/rest/get_company?id=19"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Famazon-incident-response-manager-security-operations-group-worldwide-operations-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Famazon-incident-response-manager-security-operations-group-worldwide-operations-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Famazon-incident-response-manager-security-operations-group-worldwide-operations-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/amazon-incident-response-manager-security-operations-group-worldwide-operations-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Famazon-incident-response-manager-security-operations-group-worldwide-operations-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":2717612}},{"tool":"search_jobs","arguments":{"company":"amazon.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":2717612},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}