About the role

Anthropic operates and is building data center campuses around the world, run day to day through operating partners, site vendors, and contracted security services. Things go wrong at those sites the way they go wrong at any critical infrastructure: access issues, contractor incidents, protests, weather, equipment failures, and occasionally something with the potential for global impact.

As Lead for Crisis and Incident Management, you will build the program that removes that variance, and you will build it with the people who have to live with it. The first job is definition: working with operating partners, site security vendors, managed-service providers, and internal teams to agree on what counts as a minor escalation versus a major incident of global impact, the severity levels in between, the thresholds that move an event from one level to the next, and who gets told, how fast, and in what format.

The second job is adoption: turning those definitions into playbooks, training, and exercises so that responders at every site and vendor actually respond the right way, and running the after-action reviews that show where they did not.

The third job is measurement: defining the incident metrics, building the reporting, and giving leadership a regular, accurate picture of how response is performing across the fleet.

Underneath all three sits the cross-functional work of getting partners to buy in, because a framework no partner has signed up to is a document, not a program. Continuous coverage is part of the picture. As the program matures, you will shape a 24/7 monitoring and response capability through GSOC-type managed services and site vendors, so that the framework holds at three in the morning at any site in the fleet.

That build-out follows from the definitions and partner agreements above rather than replacing them. When a major incident does happen, you run it: activation, coordination, leadership communication, stand-down, and the after-action review that makes the program better.

This is a program-building role, not a shift-supervision role. The deliverable is a framework that partners have adopted, that works at any site, and that reports on itself, run largely through vendors and managed services rather than a large in-house team. Where existing processes and vendor arrangements don't support that, you will have the authority, and the expectation, to change them.

Key responsibilities

• Build and own the global crisis and incident management program for data center physical security.
• Define, with partners, what counts as an incident and the tiers from minor site escalation to major incident of global impact, with clear thresholds, escalation and activation criteria, notification requirements, and decision rights at each tier.
• Bring operating partners, site security vendors, managed-service providers, and internal teams into the definition work so the framework is theirs as well as ours, and establish the governance that keeps it current as the fleet grows.
• Turn the framework into playbooks, training, and tabletop and functional exercises across sites and vendors, so responders know the right response before the next real incident and the escalation chain is tested by design.
• Define the incident metrics that show whether definitions are being applied and whether response is improving, build the dashboards and reporting behind them, and own the executive reporting cadence.
• Hold multiple vendors and GSOC-type providers to one standard: common definitions, common procedures, common reporting formats, common escalation triggers, with performance measured and enforced.
• Run the crisis process when an incident has multi-site or global impact: activation, coordination across sites, vendors, and internal teams, decision support to leadership, and formal stand-down.
• Run structured after-action reviews, track corrective actions to closure, and feed lessons back into definitions, playbooks, procedures, and vendor contracts.
• Design and run an always-on monitoring, escalation, and response capability through GSOC-type managed services and site security vendors, achieving continuous coverage without building a large in-house shift operation.

Minimum qualifications

• Have built or substantially rebuilt an incident management or crisis management program, including the definitions and severity model at its core, and can describe what existed before you, what you changed, and how you know it worked.
• Have brought partners you don't control into agreeing on definitions and procedures, and can describe how you won that buy-in and kept it.
• Have driven adoption: taken a framework from paper into playbooks, training, and exercises, and can point to responders behaving differently as a result.
• Have defined incident metrics and built the reporting behind them, and can explain which measures actually told leadership something and which did not.
• Know data centers: have worked physical security in or around data center or comparable critical-infrastructure operations, and understand the environment of operating partners, contractors, and 24/7 site activity.
• Have run major incidents end to end: activation, multi-party coordination, leadership communication, stand-down, and after-action, and can walk through specific ones.
• Have held vendors or managed services to defined performance standards, with evidence rather than assurances.
• Can make the severity call quickly on incomplete information, defend it either way, and adjust as facts arrive.
• Write clearly under pressure: incident report-outs can go to executives without editing.
• Work through influence across sites, vendors, and internal teams you don't control; you shape response rather than waiting to be given authority.

Preferred qualification

• Experience designing incident taxonomies, severity models, or escalation frameworks that were adopted across multiple organizations or vendors.
• Experience running an incident metrics program at scale.
• Incident command system experience.
• Experience standing up or running a global security operations center or equivalent 24/7 capability.
• Relevant certifications.
• Hyperscaler, major colocation, or critical-infrastructure operator experience.
• Business continuity or emergency management program background.
• Experience in regulated or high-assurance environments.

The annual compensation range for this role is $290,000-$365,000 USD.