Incident leadership: Act as Crisis Manager for highly complex, high-severity security incidents. Create clarity in ambiguous, fast-moving situations, use sound technical judgment to set priorities, and drive fast delivery of validated, actionable protection guidance to customers. Take part in an on-call rotation, including occasional after-hours and weekend coverage. Program definition and metrics: Find highly complex gaps and opportunities across the incident response lifecycle, using incident data, response trends and post-incident findings to spot patterns. Define goals, priorities, success criteria and performance metrics, such as time to declare, time to customer guidance and SLA adherence. Cross-organizational orchestration: Build relationships across program management, engineering, threat intelligence and incident response teams to coordinate response efforts, influence decisions and drive action across organizational boundaries. Give leadership clear, timely updates on incident status, impact and next steps. Execution and accountability: Track, coordinate and communicate end-to-end response and improvement timelines. Manage dependencies, flag risks early and hold stakeholders accountable. Plan and run pilots and rollouts of new processes and tools, aligned with team goals (OKRs and KPIs). Engineering partnership and AI/automation: Work with engineering to design integrated tooling, automation and AI solutions for complex incident response needs, with human-in-the-loop validation and responsible AI practices. Help prioritize and deliver the tooling roadmap, and make the case for the capacity and resources the team needs. Governance and continuous improvement: Drive governance for incident response, including quality standards, validation gates and publication guardrails, so customer-facing guidance is accurate, safe and compliant. Lead post-incident reviews, check that improvements meet agreed targets, and drive changes to closure across teams. Documentation, advisory and culture: Own incident response workflows, runbooks and playbooks so responses are repeatable and scale. Act as a technical advisor to partner teams, help grow the skills of other Crisis Managers, and model curiosity, inclusion and accountability. Bachelor's Degree AND 6+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience. Bachelor's Degree AND 10+ years experience in engineering, product/technical program management, data analysis, or product development OR equivalent experience. 8+ years of experience managing cross-functional and/or cross-team projects. 4+ years of experience in incident response, crisis management, or security operations. * Experience in cybersecurity or complex technical product environments. Experience applying AI tools, copilots, or agents to improve operational workflows, such as triage, summarization, drafting, or analysis. Experience working with automation systems. Experience building and running post-incident review programs that drive measurable improvement. Experience creating customer-facing security guidance, such as advisories, detection or hunting guidance, or mitigations. Technical Program Management IC5 - The typical base pay range for this role across the U.S. is USD $142,800 - $274,800 per year. There is a different range applicable to specific work locations, within the San Francisco Bay area and New York City metropolitan area, and the base pay range for this role in those locations is USD $188,000 - $304,200 per year. Certain roles may be eligible for benefits and other compensation.