{"id":354331,"url":"https://alion.io/job/ringcentral-incident-response-lead","title":"Incident response Lead","company":{"id":58779,"name":"RingCentral","domain":"ringcentral.com","url":"https://alion.io/company/ringcentral","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":80,"open_postings":14,"ghost_share":0,"stale_share":0.786,"repost_share":0,"time_to_fill_p50_days":40,"computed_at":"2026-10-29T05:49:05Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Valencia, Spain"],"countries":["ES"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":61000,"max_usd":159000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":753},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"MITRE ATT&CK","optional":true}],"status":"live","first_seen_at":"2026-08-12T00:00:00Z","employer_posted_date":"2026-08-12","last_verified_at":"2026-10-29T05:19:54Z","board_verified":true,"closed_at":null,"days_open":78,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":78},"description":"RingCentral is a global leader in agentic voice AI-powered business communications, delivering an integrated platform for business phone, SMS, contact center, workforce engagement management, video collaboration, and messaging. As the communications layer connecting businesses and customers, RingCentral is the front door of business communication and is in the advantageous position to apply AI at every phase of the conversation journey - before, during, and after each interaction. Our agentic AI portfolio includes autonomous voice-first AI agents that automate calls, assist in the moment, and analyze every interaction - enabling businesses to work smarter, respond faster, and connect more meaningfully with their customers.\nRole mission\nProtect the organisation, its customers, and its services by ensuring that potential and confirmed cybersecurity incidents are identified, assessed, contained, investigated, communicated, and resolved in a timely, disciplined, and evidence-based manner.\nResponsibilities\nIncident Leadership & Control: Ensure major security incidents are led with absolute clarity, authority, and control, establishing a structured response environment from declaration to resolution.\n\nDeclaration, Scoping & Technical Analysis: Ensure security incidents are identified and declared consistently, while accurately assessing incident scope, attacker behavior, and technical impact.\n\nThreat Containment, Eradication & Recovery: Contain active security threats before additional harm occurs, eradicate root causes, and safely restore impacted production services.\n\nStakeholder Facilitation & Multi-Audience Communication: Deliver transparent, decision-useful reporting to executives, governance teams and cross-functional partners throughout the incident lifecycle.\n\nRoot Cause Analysis (RCA) & Problem Management:Facilitate meaningful Root Cause Analyses that look beyond surface-level symptoms to produce tangible, long-term security improvements.\n\nCorrective Action & Continuous Capability Improvement: Ensure corrective actions are fully completed and verified-not merely recorded-to continuously elevate the overall incident response capability.\n\nRequired experience\nSignificant professional experience in cybersecurity, incident response, security operations, digital forensics, threat detection, or a closely related discipline.\n\nDemonstrated experience leading complex cybersecurity incidents involving multiple technical and business teams.\n\nExperience coordinating containment, eradication, recovery, and impact assessment activities.\n\nExperience communicating security incidents to senior leadership.\n\nExperience leading or facilitating root cause analyses.\n\nExperience tracking corrective actions through completion.\n\nPractical experience working with modern production environments, such as cloud platforms, containers, enterprise identity systems, networks, or customer-facing applications.\n\nAbility to participate in an on-call or major-incident escalation arrangement.\n\nExperience responding to incidents involving customer data or personal data.\n\nExperience developing incident response playbooks, severity models, reporting standards, and tabletop exercises.\n\nStrong written and spoken English.\n\nWould be a plus\nFamiliarity with NIST incident response guidance, ISO/IEC 27035, SANS incident handling practices, MITRE ATT&CK, or comparable frameworks.\n\nRelevant certifications may include GCIH, GCFA, GCFE, CISSP, CISM, or equivalent practical experience.\n\nWhat we offer\nWell-coordinated professional team;\nBreakfast in the office 4 days a week;\nCutting edge technologies, interesting and challenging tasks, dynamic project, great opportunities for self-realization, professional and career growth;\nFlexible working hours and opportunity for a hybrid work;\nJob placement and payment of salary take place according to the labor code, as well as vacation; sick lists are paid at 100% of full pay;\nMedical Insurance, including Dental and Vision;\nLife Insurance;\nVacation 23 days.","description_format":"text","description_chars":4019,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"All levels","optional":false}]},"benefits":["Flexible schedule","Health insurance","Hybrid work","Life insurance"],"hiring_locations":[{"name":"Spain","iso":"ES","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Video Conferencing & Webinars","Unified Communications","Contact Center Software"],"lifecycle":[{"event":"open","at":"2026-09-05T19:10:47Z"}],"visa":[],"liveness":{"score":17,"band":"cold","label":"Long shot","p_open":1,"p_active":0.484,"p_room":0.36,"age_days":78,"expected_fill_days":40,"reasons":["conf:0","stale_co","velocity","win:tail","crowd:"],"computed_at":"2026-10-29T05:49:05Z"},"pay":null,"html_url":"https://alion.io/job/ringcentral-incident-response-lead","json_url":"https://alion.io/job/ringcentral-incident-response-lead.json","meta":{"generated_at":"2026-10-29T07:13:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10929,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-30T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":58779},"rest":"https://alion.io/mcp/rest/get_company?id=58779"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fringcentral-incident-response-lead"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fringcentral-incident-response-lead"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fringcentral-incident-response-lead"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ringcentral-incident-response-lead\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fringcentral-incident-response-lead"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":354331}},{"tool":"search_jobs","arguments":{"company":"ringcentral.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":354331},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}