Incident Response Analyst Jobs
Incident Response Analyst jobs are open across financial services, healthcare, government contracting, and technology, from entry-level SOC analyst roles to senior threat hunter and IR team lead positions, with specializations in digital forensics, malware analysis, and cloud incident response. Find a role that fits below and apply directly.
Find JobsOverview
Showing 5 of 205+ Incident Response Analyst jobs
Security - San Francisco and US - Remote
About the team
Ensuring that advanced AI benefits humanity requires protecting the research, infrastructure, and trust that make its development and deployment possible. OpenAI Security defends our model IP, people, products, and users against sophisticated adversaries across GPU supercomputing, multicloud environments, datacenters, and emerging agent systems. The Security Incident Response Team (SIRT) leads the response when those defenses are tested—establishing what happened, limiting harm, and strengthening our ability to protect frontier AI.
About the role
We’re looking for a hands-on technical leader to build the incident response team that protects OpenAI as AI capabilities and the threats surrounding them evolve. You will command consequential incidents, lead technically demanding investigations, and make containment and recovery decisions when evidence is incomplete and the stakes are high. You will also shape how frontier models change incident response: using OpenAI’s own technology to help responders connect evidence, test hypotheses, and act effectively at a scale that manual workflows cannot support. Partnering with Research, Infrastructure, Product Security, Enterprise Security, IT, and Engineering, you will build exceptional responders, dependable AI-powered capabilities, and stronger defenses through every investigation.
In this role, you will:
Hire, coach, and develop exceptional incident responders who combine investigative depth, engineering ability, and sound judgment. Build a team that challenges assumptions, surfaces uncertainty early, and uses AI to expand its capabilities. Develop technical leaders who can make and explain difficult decisions under pressure.
Lead incident command for complex threats to OpenAI’s research, products, and infrastructure. Establish severity and scope, coordinate investigation workstreams, and weigh containment options against ongoing exposure and disruption to research or production.
Build and ship agentic capabilities using OpenAI’s models for evidence collection engineers to integrate tools and data, evaluate accuracy and failure modes, and ensure reliable, auditable operation with human approval for consequential actions.
Set investigation standards for sophisticated adversaries and insider threats across identity, endpoints, cloud, Kubernetes, and large-scale compute. Help responders reconstruct activity, test competing hypotheses, preserve evidence, and make uncertainty explicit.
Drive incidents to verified closure. Work with accountable owners to validate containment and recovery, document remaining risk, and track corrective actions that reduce the likelihood or impact of recurrence.
Coordinate with engineering, infrastructure, legal, privacy, and other stakeholders throughout an incident. Give executives clear updates on impact, uncertainty, decisions, and the next update without overstating what the evidence supports.
Build sustainable on-call coverage, escalation paths, and handoffs across regions. Balance urgent response with training and planned improvements, and protect the team’s ability to recover after demanding incidents.
Build readiness into new research and infrastructure capabilities with their owners. Exercise playbooks, escalation paths, and containment options, including scenarios involving agents operating across systems at scale.
Turn incident evidence into stronger defenses with Detection Engineering teams. Identify what should have exposed an intrusion earlier, what prevented a faster or more confident investigation, and which capabilities would have changed the outcome. Translate those findings into tested improvements with clear owners.
Prioritize improvements using incident outcomes and readiness evidence. Measure response quality and effectiveness, make tradeoffs explicit, and address recurring friction without reducing success to ticket volume or speed alone.
You might thrive if you:
You are motivated by the responsibility of protecting frontier AI. You want to understand how powerful new systems can fail or be compromised, help their builders move forward securely, and use the same advances in AI to strengthen defenders.
You have managed security responders or a closely related technical operations team, with a record of hiring, coaching, delivering candid feedback, and helping people grow.
You bring strong AI fluency and an AI-first builder mindset. You have used models or agents to improve real investigation or response workflows and can show validated results. You understand their failure modes and pair ambitious automation with rigorous evaluations and human judgment.
You are a hands-on builder with deep investigation expertise across identity, cloud, host, and infrastructure systems. You can prototype tools, write scripts or code, and coach responders through difficult evidence questions, including unfamiliar parts of the stack.
You have commanded consequential incidents involving capable adversariesation, recognize when new evidence requires a change in direction, and remain accountable for the consequences.
You communicate clearly with engineers, executives, and legal or privacy partners. You can explain uncertainty, document decision rationale, and keep stakeholders aligned as facts change.
You have improved on-call operations, response playbooks, or exercise programs, and understand how workload, handoffs, and team health affect response quality.
You can prioritize a small number of meaningful improvements, influence partners who own remediation, and follow through until the agreed outcome has been verified.
About OpenAI
OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core the full spectrum of humanity.
We are an equal opportunity employeration, or other applicable legally protected characteristic.
Background checks for applicants will be administered in accordance with applicable lawation technology systems and related data security obligations.
To notify OpenAI that you believe this job posting is non-compliant. No response will be provided to inquiries unrelated to job posting compliance.
We are committed to providing reasonable accommodations to applicants with disabilities.
At OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.
Compensation
$401K – $510K + Offers Equity
The base pay offered may vary depending on multiple individualized factorsance-related bonus(es) for eligible employees, and the following benefits.
Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts
Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)
401(k) retirement plan with employer match
Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents), plus paid medical and caregiver leave (up to 8 weeks)
Paid time off: flexible PTO for exempt employees and up to 15 days annually for non-exempt employees
13+ paid company holidays, and multiple paid coordinated company office closures throughout the year for focus and recharge, plus paid sick or safe time (1 hour per 30 hours worked, or more, as required by applicable state or local law)
Mental health and wellness support
Employer-paid basic life and disability coverage
Annual learning and development stipend to fuel your professional growth
Daily meals in our offices, and meal delivery credits as eligible
Relocation support for eligible employees
Additional taxable fringe benefits, such as charitable donation matching and wellness stipends, may also be provided.
More details about our benefits are available to candidates during the hiring process.
This role is at-will and OpenAI reserves the right to modify base pay and other compensation components at any time based on individual performance, team or company results, or market conditions.
Security - San Francisco and US - Remote
About the team
Ensuring that advanced AI benefits humanity requires protecting the research, infrastructure, and trust that make its development and deployment possible. OpenAI Security defends our model IP, people, products, and users against sophisticated adversaries across GPU supercomputing, multicloud environments, datacenters, and emerging agent systems. The Security Incident Response Team (SIRT) leads the response when those defenses are tested—establishing what happened, limiting harm, and strengthening our ability to protect frontier AI.
About the role
We’re looking for a hands-on technical leader to build the incident response team that protects OpenAI as AI capabilities and the threats surrounding them evolve. You will command consequential incidents, lead technically demanding investigations, and make containment and recovery decisions when evidence is incomplete and the stakes are high. You will also shape how frontier models change incident response: using OpenAI’s own technology to help responders connect evidence, test hypotheses, and act effectively at a scale that manual workflows cannot support. Partnering with Research, Infrastructure, Product Security, Enterprise Security, IT, and Engineering, you will build exceptional responders, dependable AI-powered capabilities, and stronger defenses through every investigation.
In this role, you will:
Hire, coach, and develop exceptional incident responders who combine investigative depth, engineering ability, and sound judgment. Build a team that challenges assumptions, surfaces uncertainty early, and uses AI to expand its capabilities. Develop technical leaders who can make and explain difficult decisions under pressure.
Lead incident command for complex threats to OpenAI’s research, products, and infrastructure. Establish severity and scope, coordinate investigation workstreams, and weigh containment options against ongoing exposure and disruption to research or production.
Build and ship agentic capabilities using OpenAI’s models for evidence collection engineers to integrate tools and data, evaluate accuracy and failure modes, and ensure reliable, auditable operation with human approval for consequential actions.
Set investigation standards for sophisticated adversaries and insider threats across identity, endpoints, cloud, Kubernetes, and large-scale compute. Help responders reconstruct activity, test competing hypotheses, preserve evidence, and make uncertainty explicit.
Drive incidents to verified closure. Work with accountable owners to validate containment and recovery, document remaining risk, and track corrective actions that reduce the likelihood or impact of recurrence.
Coordinate with engineering, infrastructure, legal, privacy, and other stakeholders throughout an incident. Give executives clear updates on impact, uncertainty, decisions, and the next update without overstating what the evidence supports.
Build sustainable on-call coverage, escalation paths, and handoffs across regions. Balance urgent response with training and planned improvements, and protect the team’s ability to recover after demanding incidents.
Build readiness into new research and infrastructure capabilities with their owners. Exercise playbooks, escalation paths, and containment options, including scenarios involving agents operating across systems at scale.
Turn incident evidence into stronger defenses with Detection Engineering teams. Identify what should have exposed an intrusion earlier, what prevented a faster or more confident investigation, and which capabilities would have changed the outcome. Translate those findings into tested improvements with clear owners.
Prioritize improvements using incident outcomes and readiness evidence. Measure response quality and effectiveness, make tradeoffs explicit, and address recurring friction without reducing success to ticket volume or speed alone.
You might thrive if you:
You are motivated by the responsibility of protecting frontier AI. You want to understand how powerful new systems can fail or be compromised, help their builders move forward securely, and use the same advances in AI to strengthen defenders.
You have managed security responders or a closely related technical operations team, with a record of hiring, coaching, delivering candid feedback, and helping people grow.
You bring strong AI fluency and an AI-first builder mindset. You have used models or agents to improve real investigation or response workflows and can show validated results. You understand their failure modes and pair ambitious automation with rigorous evaluations and human judgment.
You are a hands-on builder with deep investigation expertise across identity, cloud, host, and infrastructure systems. You can prototype tools, write scripts or code, and coach responders through difficult evidence questions, including unfamiliar parts of the stack.
You have commanded consequential incidents involving capable adversariesation, recognize when new evidence requires a change in direction, and remain accountable for the consequences.
You communicate clearly with engineers, executives, and legal or privacy partners. You can explain uncertainty, document decision rationale, and keep stakeholders aligned as facts change.
You have improved on-call operations, response playbooks, or exercise programs, and understand how workload, handoffs, and team health affect response quality.
You can prioritize a small number of meaningful improvements, influence partners who own remediation, and follow through until the agreed outcome has been verified.
About OpenAI
OpenAI is an AI research and deployment company dedicated to ensuring that general-purpose artificial intelligence benefits all of humanity. We push the boundaries of the capabilities of AI systems and seek to safely deploy them to the world through our products. AI is an extremely powerful tool that must be created with safety and human needs at its core the full spectrum of humanity.
We are an equal opportunity employeration, or other applicable legally protected characteristic.
Background checks for applicants will be administered in accordance with applicable lawation technology systems and related data security obligations.
To notify OpenAI that you believe this job posting is non-compliant. No response will be provided to inquiries unrelated to job posting compliance.
We are committed to providing reasonable accommodations to applicants with disabilities.
At OpenAI, we believe artificial intelligence has the potential to help people solve immense global challenges, and we want the upside of AI to be widely shared. Join us in shaping the future of technology.
Compensation
$401K – $510K + Offers Equity
The base pay offered may vary depending on multiple individualized factorsance-related bonus(es) for eligible employees, and the following benefits.
Medical, dental, and vision insurance for you and your family, with employer contributions to Health Savings Accounts
Pre-tax accounts for Health FSA, Dependent Care FSA, and commuter expenses (parking and transit)
401(k) retirement plan with employer match
Paid parental leave (up to 24 weeks for birth parents and 20 weeks for non-birthing parents), plus paid medical and caregiver leave (up to 8 weeks)
Paid time off: flexible PTO for exempt employees and up to 15 days annually for non-exempt employees
13+ paid company holidays, and multiple paid coordinated company office closures throughout the year for focus and recharge, plus paid sick or safe time (1 hour per 30 hours worked, or more, as required by applicable state or local law)
Mental health and wellness support
Employer-paid basic life and disability coverage
Annual learning and development stipend to fuel your professional growth
Daily meals in our offices, and meal delivery credits as eligible
Relocation support for eligible employees
Additional taxable fringe benefits, such as charitable donation matching and wellness stipends, may also be provided.
More details about our benefits are available to candidates during the hiring process.
This role is at-will and OpenAI reserves the right to modify base pay and other compensation components at any time based on individual performance, team or company results, or market conditions.
Incident Response Analyst Jobs by Experience Level
See All 205+ Incident Response Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsIncident Response Analyst Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Investment & Asset Management
- Education
- Science & Research
- Sports & Recreation
What Employers Look For
The qualifications that appear most often in incident response analyst jobs.
- Three or more years of hands-on experience investigating and containing security incidents
- Proficiency with SIEM platforms such as Splunk, Microsoft Sentinel, or IBM QRadar
- Working knowledge of digital forensics tools including EnCase, FTK, or Volatility
- Relevant certification such as GCIH, GCFE, CompTIA Security+, or CEH
- Bachelor's degree in cybersecurity, computer science, information systems, or a related field
- Familiarity with network traffic analysis tools and endpoint detection and response platforms
Tips for Your Incident Response Analyst Job Search
Tailor your resume to the breach lifecycle
Incident response analysts are hired to contain and investigate specific threat scenarios. Structure your resume around the IR lifecycle: detection, containment, eradication, and recovery. Hiring managers scan for evidence you've owned at least one full phase under real incident conditions.
Certify before you apply to senior roles
GCIH, GCFE, and GCFA credentials appear in a large share of mid-to-senior IR analyst postings. If you hold CompTIA Security+ but lack a GIAC cert, target junior or associate-level listings and frame the cert as in progress.
Apply early to roles that fit
Migrate Mate lists incident response analyst openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Match your toolkit to the job description
Many IR postings specify platforms like Splunk, CrowdStrike Falcon, or Microsoft Sentinel. Pull the exact tool names from each listing and mirror that language in your resume's skills section and your cover letter's opening paragraph.
Prepare a walk-through of one real incident
Expect at least one technical interview round structured around a live scenario or a past case you worked. Prepare a concise, chronological narrative of one real incident you handled, covering your initial indicators, containment decision, and post-incident write-up findings.
Negotiate scope before you negotiate salary
Before accepting an IR analyst offer, clarify on-call rotation frequency, escalation authority during active incidents, and whether the role is embedded in a SOC or standalone. These factors affect burnout risk and career trajectory more than base pay in this discipline.
Incident Response Analyst Jobs: Frequently Asked Questions
Which companies are hiring the most incident response analysts?
Wilson Elser, Amazon, and Allied Universal are hiring the most incident response analysts right now, with openings concentrated in California, Virginia, and Texas, based on current listings on Migrate Mate as of November 2026. Government contractors and financial institutions consistently represent a large share of active postings.
How many incident response analyst jobs are remote?
About 83% of incident response analyst openings are fully remote or hybrid as of November 2026, though the share varies by sector. Threat intelligence and cloud-focused IR roles tend to offer the most remote flexibility, while positions tied to on-premises forensics labs or classified government environments typically require on-site presence.
How do you become an incident response analyst?
Start by building a foundation in networking, operating systems, and security fundamentals, then earn an entry-level certification such as CompTIA Security+ or CompTIA CySA+. Move into a SOC analyst or IT security role to gain hands-on alert triage experience. From there, pursue GIAC certifications and document your direct involvement in incident investigations to qualify for dedicated IR analyst positions.
Can you get hired as an incident response analyst with little experience?
Yes, some employers hire candidates into junior IR analyst or associate SOC roles with limited professional experience if you can demonstrate practical skills through a home lab, CTF competitions, or documented personal projects involving forensic analysis or malware sandboxing. Certifications like GCIH or hands-on platforms that log your activity give hiring managers a concrete skills signal when your work history is thin.
What does the incident response analyst interview process look like?
Most IR analyst interview processes include an initial screening call, a technical phone or video interview covering threat detection concepts and tool familiarity, and a live or take-home scenario exercise where you walk through an incident from initial alert to remediation. Senior roles often add a final panel discussion with the security engineering or SOC leadership team focused on your decision-making process under pressure.
Where can I find and apply to incident response analyst jobs?
You can find and apply to incident response analyst jobs on Migrate Mate, which lists current openings from across the United States. Search for roles that match your experience level and specialization, then apply directly to each listing that fits.
See All 205+ Incident Response Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs