{"id":3535211,"url":"https://alion.io/job/arctic-wolf-incident-commander","title":"Incident Commander","company":{"id":1025,"name":"Arctic Wolf","domain":"arcticwolf.com","url":"https://alion.io/company/arctic-wolf","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":89,"open_postings":17,"ghost_share":0,"stale_share":0.353,"repost_share":0.118,"time_to_fill_p50_days":39,"computed_at":"2026-11-04T06:34:25Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Waterloo, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":65000,"max":143000,"currency":"CAD","period":"year","gross":null,"usd_annual":102626},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Grafana","optional":false},{"name":"Incident Management","optional":false},{"name":"Jira","optional":false},{"name":"Kibana","optional":false},{"name":"Unix","optional":false}],"status":"live","first_seen_at":"2026-10-30T17:22:36Z","employer_posted_date":"2026-10-30","last_verified_at":"2026-11-04T05:31:08Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"#RunwiththePack\nAt Arctic Wolf, we’re on a mission to end cyber risk.\nWe are a global leader in security operations, helping organizations stay resilient against evolving cyber threats through industry-leading security operations, threat intelligence, and a people-first approach to cybersecurity.\nMore than 3,000 Pack members across the world work together every day to protect our customers and empower security teams with new levels of speed, accuracy, and intelligence at scale. What sets us apart is our relentless focus on our customers, innovation at scale, and a collaborative culture where talented people can do meaningful work that truly makes a difference.\nWe’re constantly looking for talented people to join the Pack and help us take our performance to the next level.\nAbout the Position:\nPosition Overview\nOperational Incident Commander responsible for solo commanding service incidents of any severity, including Sev1 and Sev2, from detection through technical resolution and through the postmortem that follows. This is the role that puts hands on the wheel during an active incident: assembling the response team, running the bridge, driving investigation, coordinating remediation in real time, and closing the loop with a postmortem and templated status communications.\nGiven the size of the Incident Commander team, Level 1 cannot be a narrow, entry-only role; it has to be able to run the full lifecycle of a routine incident independently, including publishing templated status updates and facilitating the postmortem for incidents it personally commanded. What Level 1 does not own is judgment that carries cross organizational visibility: finalizing severity for Sev1/Sev2, deciding on communications that fall outside the standard template, and authoring the formal RCA document sit with Level 2.\nPrimary Responsibilities and Duties\nSolo command incidents at any severity (Sev1 through Sev4) from detection through technical resolution, including Sev1/Sev2 incidents\nAssemble the appropriate response team and lead the command bridge (Zoom, incident channel) for the incident's duration\nMonitor and triage incoming incidents using Jira, Zendesk, and Statuspage; propose an initial severity assessment\nLead technical investigation using Kibana, Grafana, and Unix command line tools to identify probable cause and drive remediation\nGather input from tech leads and subject matter experts on symptoms, fixes, and remediation risk, and drive the incident to technical resolution\nAuthor and publish templated status page and incident updates directly, using existing templates\nDocument the incident timeline, actions taken, and outcomes in real time in the incident tracking tool\nRun the postmortem for incidents using existing templates, and drive resulting action items to closure\nChair COE Review meetings\nFollow and execute against existing incident response playbooks; flag gaps or outdated steps to a Level 2 Incident Commander\nHand off RCA authorship and any communications that fall outside the standard template to a Level 2 Incident Commander at the appropriate point during, or immediately following, the incident\nEscalate incidents that carry ambiguous severity, cross organizational risk, or customer/reputational risk to a Level 2 or Level 3 Incident Commander\nKey Skills\nWorking knowledge of incident management and monitoring tooling (Jira, Zendesk, Statuspage, Kibana, Grafana)\nWorking Unix command line proficiency\nAbility to stay calm, decisive, and organized while running a live bridge under time pressure\nStructured troubleshooting and technical investigation\nComfort writing clear, templated customer facing status updates and facilitating a structured postmortem meeting\nAbility to recognize when a decision exceeds this level's scope and hand it off cleanly\nMinimum Qualifications\n0 to 3 years of IT support, NOC, or incident management experience\nTechnical degree, diploma, or equivalent practical experience\nDemonstrated interest in networking, systems operations, or cybersecurity\nCustomer facing experience in any capacity\nBenefits\nAll wolves receive compelling compensation and benefits packages, including:\nEquity for all employees \nFlexible time off and paid volunteer days \nRRSP contribution and matching\nTraining and career development programs \nComprehensive private benefits plan including medical, mental health, dental, disability, life and AD&D, and value-added services \nRobust Employee Assistance Program (EAP) with mental health services \nFamily-forming benefits, enhanced maternity benefits, and paid parental leave\nSecurity Requirements\nAt Arctic Wolf, protecting our people, customers, and data is fundamental to how we operate. All employees are expected to uphold our commitment to security, privacy, and compliance by following internal information security policies, standards, and controls designed to safeguard the confidentiality, integrity, and availability of business, customer, employee, and other confidential information and to support compliance with applicable legal and regulatory requirements.\nDepending on the role and where permitted by applicable law, employment may be subject to background verification and additional regulatory, security, or compliance requirements, including obligations related to data protection and export control laws, and authorization requirements where applicable.\nBase Salary\nThe base salary range for this job family is 65,000 to 143,000 CAD annually. This range reflects the base pay the company reasonably expects to offer for this position, aligned to the broader job family base pay structure. Actual base pay may vary based on skills, experience, and location, including job family level. In addition to base pay, Arctic Wolf offers variable incentive compensation, new hire equity grants, and a comprehensive benefits package.Your next big opportunity starts here - apply today and help us end cyber risk.","description_format":"text","description_chars":5927,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible time off","Parental leave"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Endpoint Security","Security Operations","Managed Security"],"lifecycle":[{"event":"open","at":"2026-10-30T17:22:36Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":4,"expected_fill_days":39,"reasons":["conf:1","velocity","win:early","comp:junior,brand"],"computed_at":"2026-11-04T06:34:25Z"},"pay":{"stated_usd_annual":102626,"is_top_pay":false},"html_url":"https://alion.io/job/arctic-wolf-incident-commander","json_url":"https://alion.io/job/arctic-wolf-incident-commander.json","meta":{"generated_at":"2026-11-04T09:31:34Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14868,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-05T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1025},"rest":"https://alion.io/mcp/rest/get_company?id=1025"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farctic-wolf-incident-commander"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farctic-wolf-incident-commander"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farctic-wolf-incident-commander"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/arctic-wolf-incident-commander\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farctic-wolf-incident-commander"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3535211}},{"tool":"search_jobs","arguments":{"company":"arcticwolf.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3535211},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}