Incident Escalations Coordinator

As a Ping Incident Escalations Coordinator, you will provide Level 2 incident response and escalation support within the Cyber Security Engineering team. You will help coordinate complex security incidents, improve incident readiness, and ensure that lessons learned are converted into practical improvements.

This is an individual contributor role, combining technical incident response experience with strong operational coordination. You will work closely with CSE engineers and cross-functional teams to maintain momentum during incidents, support tabletop exercises, and improve our incident response capability.

You will

• Act as a Level 2 escalation point for CSE engineers during complex or high-risk security incidents
• Coordinate incident response across Cyber Security, Engineering, Infrastructure, Cloud, IT, Product, and other relevant teams
• Establish incident priorities, ownership, actions, dependencies, and communication cadence
• Support investigation, containment, eradication, recovery, and validation activities
• Maintain accurate incident timelines, decision records, action logs, and stakeholder updates
• Prepare and support cyber security tabletop exercises, including scenarios, injects, facilitation, and follow-up actions
• Develop and improve incident response playbooks, runbooks, escalation paths, and readiness procedures
• Lead or support post-incident reviews and ensure lessons learned are converted into tracked improvements
• Identify recurring response gaps, operational risks, and opportunities for automation or process improvement
• Participate in the Cyber Security Engineering on-call or escalation rota, where required
• Collaborate cross-functionally to improve incident response readiness and security outcomes

Requirements

• Experience in cyber security engineering, incident response, security operations, SRE, or technical operations
• Experience responding to or coordinating security incidents involving multiple teams
• Strong operational judgement and the ability to make decisions under pressure and with incomplete information
• Experience acting as an incident lead, technical lead, escalation point, or senior responder
• Strong written and verbal communication skills, with the ability to communicate technical risk clearly to technical and non-technical audiences
• Experience creating or improving incident response playbooks, runbooks, procedures, or post-incident reviews
• Experience conducting, facilitating, or supporting tabletop or operational readiness exercises
• Ability to influence and coordinate teams without direct reporting authority
• Experience with security investigation and response tooling, such as SIEM, EDR, cloud logging, identity telemetry, or security orchestration platforms
• Strong understanding of cloud environments, preferably AWS and/or GCP
• Understanding of enterprise and SaaS operational environments
• On-call and escalation participation is a requirement for this position

You have an advantage if:

• Experience with Google SecOps and YARA-L
• Experience with security orchestration, automation, and bespoke scripting
• Experience working with Kubernetes and Docker in development or incident response contexts
• Experience with threat intelligence, detection engineering, EDR, identity response, or cloud forensics
• Experience improving incident response maturity, operational metrics, or security operating procedures