{"id":467913,"url":"https://alion.io/job/thrive-managed-services-incident-commander-cirt","title":"Incident Commander - CIRT","company":{"id":179780,"name":"Thrive Managed Services","domain":"thrivenextgen.com","url":"https://alion.io/company/thrive-3","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":96,"open_postings":10,"ghost_share":0,"stale_share":0,"repost_share":0.3,"time_to_fill_p50_days":27,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Mabalacat, Philippines"],"countries":["PH"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Cyber Kill Chain","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false},{"name":"Crowdstrike","optional":true},{"name":"SentinelOne","optional":true}],"status":"live","first_seen_at":"2026-10-07T04:03:59Z","employer_posted_date":"2026-10-07","last_verified_at":"2026-10-28T01:52:40Z","board_verified":true,"closed_at":null,"days_open":21,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":21},"description":"About Us:\nThrive is a rapidly growing technology solutions provider focusing upon Cloud, Cyber Security, Networking, Disaster Recovery and Managed Services. Our corporate culture, engineering talent, customer-centric approach, and focus upon “next generation” services help us stand out amongst our peers. Thrive is on the look-out for individuals who don’t view their weekdays spent at “a job”, but rather look to develop valuable skills that ignite their passion and lead to a CAREER. If you’re attracted to a “work hard, play hard” environment, seeking the guidance, training and experience necessary to build a lucrative career, then welcome to THRIVE!!\nPosition Overview:\nThrive is expanding its cybersecurity capabilities and is seeking a highly capable Incident Commander to lead critical security incident operations across our organization. This role is essential for directing and coordinating all activities and resources involved in a security incident, ensuring alignment across internal Thrive teams and with client stakeholders.\nThe Incident Commander acts as the single point of accountability for the lifecycle of high-severity incidents-driving containment, eradication, recovery, and client communication with authority and clarity. This leader must possess both technical fluency and strong executive presence to guide multi-team efforts under pressure.\nPrimary Responsibilities:\nServe as the lead Incident Commander for complex or high-priority cybersecurity incidents, assuming control from initial scoping through post-incident review.\nAct as the central coordination point across all parties engaged in security incidents\nEnsure that all internal actions are synchronized, prioritized, and in alignment with client needs and Thrive’s incident response methodology.\nSet the operational tempo, assign task owners, and communicate timelines, dependencies, and roadblocks in real-time.\nDrive incident lifecycle management with a focus on containment, minimizing business disruption, and maintaining security assurance.\nMaintain clear, structured communication with client stakeholders and Thrive leadership, including updates on threat actor behavior, system impact, business risk, and required decisions.\nLead conference bridges during incident response, ensuring everyone is aligned and progressing toward resolution.\nApprove restoration plans, re-entry conditions, and sequencing to minimize risk of re-compromise.\nServe as the public face of Thrive during a cybersecurity crisis, guiding clients with authority and confidence through incident containment and recovery.\nProvide real-time risk assessments and business impact updates to client executive teams, IT leads, and legal stakeholders.\nAssist clients in coordination with cyber insurance or legal counsel when applicable.\nAdvocate for long-term maturity improvements post-incident, helping position Thrive as a trusted partner.\nContinually enhance Thrive’s playbooks, escalation frameworks, and IR documentation based on lessons learned from real-world incidents.\nLead internal after-action reviews and root cause analysis meetings with technical teams and business units.\nPartner with Security Engineering to validate detection coverage and response automation opportunities.\nConduct tabletop with internal Thrive teams to test and improve readiness for various threat scenarios.\nPromote a strong, communicative culture of shared accountability and post-incident learning across all Thrive teams.\nRequirements\n Qualifications:\nProven incident response experience with demonstrated leadership of cross-functional security teams.\nProven success commanding high-impact cybersecurity incidents in a fast-paced, customer-facing environment.\nStrong understanding of attack lifecycle stages, investigative workflows, and containment best practices.\nDeep knowledge of modern attacker tactics and incident frameworks (MITRE ATT&CK, Cyber Kill Chain, NIST 800-61).\nExcellent communication skills, with experience briefing clients, executives, and cross-disciplinary teams.\nFamiliarity with security tools (SIEM, EDR, forensic platforms), system/network architecture, incident response methodologies, and backup and disaster recovery plans.\nAbility to multitask and make decisions quickly under pressure.\nPreferred Experience:\nExperience with MSSP coordination, including multi-tenant incident response and customer escalation management.\nFamiliarity with tools like SentinelOne, Microsoft 365 Defender, Fortinet, CrowdStrike, and similar platforms.\nExperience integrating legal, compliance, or insurance considerations into incident decision-making.\nPreferred Certifications\nGCIH - GIAC Certified Incident Handler\nGCFA - GIAC Certified Forensic Analyst\nGCFE - GIAC Certified Forensic Examiner\nCHFI - Computer Hacking Forensic Investigator\nCISSP, CISM, or other management-level security certifications are a plus","description_format":"text","description_chars":4884,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Technology","Information Security","Managed Security","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-09-06T12:26:39Z"},{"event":"close","at":"2026-09-24T08:23:28Z"},{"event":"reopen","at":"2026-09-25T07:46:50Z"},{"event":"close","at":"2026-09-29T14:52:53Z"},{"event":"reopen","at":"2026-10-07T02:42:09Z"}],"visa":[],"liveness":{"score":59,"band":"ok","label":"Likely open","p_open":1,"p_active":0.789,"p_room":0.75,"age_days":21,"expected_fill_days":27,"reasons":["conf:4","velocity","win:late"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/thrive-managed-services-incident-commander-cirt","json_url":"https://alion.io/job/thrive-managed-services-incident-commander-cirt.json","meta":{"generated_at":"2026-10-28T06:21:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8331,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":179780},"rest":"https://alion.io/mcp/rest/get_company?id=179780"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fthrive-managed-services-incident-commander-cirt"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fthrive-managed-services-incident-commander-cirt"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fthrive-managed-services-incident-commander-cirt"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/thrive-managed-services-incident-commander-cirt\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fthrive-managed-services-incident-commander-cirt"}]}