Incident Management Lead, Data Center Security

About the role

Anthropic operates and is building data center campuses around the world, run day to day through operating partners, site vendors, and contracted security services. Things go wrong at those sites the way they go wrong at any critical infrastructure: access issues, contractor incidents, protests, weather, equipment failures, and occasionally something with the potential for global impact. Today, what counts as an incident, who gets told, and how it is reported vary by site and by vendor.

As Lead for Crisis and Incident Management, you will build the program that removes that variance, and you will build it with the people who have to live with it. The first job is definition: working with operating partners, site security vendors, managed-service providers, and internal teams to agree on what counts as a minor escalation versus a major incident of global impact, the severity levels in between, the thresholds that move an event from one level to the next, and who gets told, how fast, and in what format. The second job is adoption: turning those definitions into playbooks, training, and exercises so that responders at every site and vendor actually respond the right way, and running the after-action reviews that show where they did not. The third job is measurement: defining the incident metrics, building the reporting, and giving leadership a regular, accurate picture of how response is performing across the fleet. Underneath all three sits the cross-functional work of getting partners to buy in, because a framework no partner has signed up to is a document, not a program.

Continuous coverage is part of the picture. As the program matures, you will shape a 24/7 monitoring and response capability through GSOC-type managed services and site vendors, so that the framework holds at three in the morning at any site in the fleet. That build-out follows from the definitions and partner agreements above rather than replacing them. When a major incident does happen, you run it: activation, coordination, leadership communication, stand-down, and the after-action review that makes the program better.

This is a program-building role, not a shift-supervision role. The deliverable is a framework that partners have adopted, that works at any site, and that reports on itself, run largely through vendors and managed services rather than a large in-house team. Where existing processes and vendor arrangements don't support that, you will have the authority, and the expectation, to change them.

Role boundaries. This seat is distinct from the Data Center Security Delivery Lead (who owns security through construction, commissioning, and handover on new builds), from regional security operations leads (who own steady-state regional programs and vendor relationships site by site), and from the team's systems-engineering roles (who build platforms and tooling). This role owns the horizontal incident and crisis layer across the operating fleet: the incident definitions and severity framework, partner adoption and governance, incident reporting and metrics, major incident command, post-incident review, and, as it develops, the 24/7 coverage model, applied consistently across every site and vendor.

Key responsibilities

You will build and own the global crisis and incident management program for data center physical security.

• Incident definition and severity framework: define, with partners, what counts as an incident and the tiers from minor site escalation to major incident of global impact, with clear thresholds, escalation and activation criteria, notification requirements, and decision rights at each tier. This is the foundation the rest of the program is built on.

• Cross-functional partner buy-in and governance: bring operating partners, site security vendors, managed-service providers, and internal teams into the definition work so the framework is theirs as well as ours, and establish the governance (owners, review cadence, change process) that keeps it current as the fleet grows.

• Adoption and response readiness: turn the framework into playbooks, training, and tabletop and functional exercises across sites and vendors, so responders know the right response before the next real incident and the escalation chain is tested by design.

• Metrics and reporting: define the incident metrics that show whether definitions are being applied and whether response is improving, build the dashboards and reporting behind them, and own the executive reporting cadence, from real-time notification through leadership escalation and executive summaries.

• Vendor and managed-service consistency: hold multiple vendors and GSOC-type providers to one standard: common definitions, common procedures, common reporting formats, common escalation triggers, with performance measured and enforced.

• Major incident management: run the crisis process when an incident has multi-site or global impact: activation, coordination across sites, vendors, and internal teams, decision support to leadership, and formal stand-down.

• Post-incident review and improvement: run structured after-action reviews, track corrective actions to closure, and feed lessons back into definitions, playbooks, procedures, and vendor contracts.

• 24/7 coverage model: as the program matures, design and run an always-on monitoring, escalation, and response capability through GSOC-type managed services and site security vendors, achieving continuous coverage without building a large in-house shift operation.

Minimum qualifications

• Have built or substantially rebuilt an incident management or crisis management program (not just operated within one), including the definitions and severity model at its core, and can describe what existed before you, what you changed, and how you know it worked.

• Have brought partners you don't control (operators, vendors, internal teams) into agreeing on definitions and procedures, and can describe how you won that buy-in and kept it.

• Have driven adoption: you have taken a framework from paper into playbooks, training, and exercises, and can point to responders behaving differently as a result.

• Have defined incident metrics and built the reporting behind them, and can explain which measures actually told leadership something and which did not.

• Know data centers: you have worked physical security in or around data center or comparable critical-infrastructure operations, and understand the environment of operating partners, contractors, and 24/7 site activity.

• Have run major incidents end to end: activation, multi-party coordination, leadership communication, stand-down, and after-action, and can walk through specific ones.

• Have held vendors or managed services (a GSOC, monitoring provider, or guard force) to defined performance standards, with evidence rather than assurances.

• Can make the severity call quickly on incomplete information, defend it either way, and adjust as facts arrive.

• Write clearly under pressure: your incident report-outs can go to executives without editing.

• Work through influence across sites, vendors, and internal teams you don't control; you shape response rather than waiting to be given authority.

Preferred qualification

• Experience designing incident taxonomies, severity models, or escalation frameworks that were adopted across multiple organizations or vendors.

• Experience running an incident metrics program at scale (dashboards and an executive reporting cadence spanning multiple sites or vendors).

• Incident command system experience (ICS/NIMS or comparable).

• Experience standing up or running a global security operations center (GSOC) or equivalent 24/7 capability.

• CPP (Certified Protection Professional), PSP (Physical Security Professional), CEM (Certified Emergency Manager), CBCP, or comparable certifications.

• Hyperscaler, major colocation, or critical-infrastructure operator experience.

• Business continuity or emergency management program background.

• Experience in regulated or high-assurance environments.