The role sits at the intersection of real-time incident command and intelligent automation, combining hands-on leadership during the enterprise's most critical moments with the strategic work of ...
The role sits at the intersection of real-time incident command and intelligent automation, combining hands-on leadership during the enterprise's most critical moments with the strategic work of ...
Serve as the Incident Commander during major cybersecurity events when required. * Analyze attacker tactics, techniques, and procedures (TTPs) and map findings to the MITRE ATT&CK framework.
Serve as the Incident Commander during major cybersecurity events when required. * Analyze attacker tactics, techniques, and procedures (TTPs) and map findings to the MITRE ATT&CK framework.
Own major incident command for all Sev-0 and Sev-1 events, security and operational, including customer-facing communications and regulatory notification decisions * Develop detection-to-containment ...
Own major incident command for all Sev-0 and Sev-1 events, security and operational, including customer-facing communications and regulatory notification decisions * Develop detection-to-containment ...
Director of Incident Response
Dallas, TX · On-site
Own major incident command for all Sev-0 and Sev-1 events, security and operational, including customer-facing communications and regulatory notification decisions * Develop detection-to-containment ...
Director of Incident Response
Dallas, TX · On-site
Own major incident command for all Sev-0 and Sev-1 events, security and operational, including customer-facing communications and regulatory notification decisions * Develop detection-to-containment ...
Major Incident Commander
Temple, TX · Hybrid
Command real-time incident bridge calls, coordinating cross-functional technical teams. * Drive rapid triage, containment, and service restoration. * Provide clear, executive-level communications and ...
Major Incident Commander
Temple, TX · Hybrid
Command real-time incident bridge calls, coordinating cross-functional technical teams. * Drive rapid triage, containment, and service restoration. * Provide clear, executive-level communications and ...
PepsiCo is seeking a Cybersecurity Incident Management Commander to lead their response to high-impact cyber security incidents. This role involves maintaining the incident response plan, conducting ...
PepsiCo is seeking a Cybersecurity Incident Management Commander to lead their response to high-impact cyber security incidents. This role involves maintaining the incident response plan, conducting ...
Cyber Incident Response Analys
Austin, TX · On-site
Perform host-based forensics, investigate security incidents, analyze threats, coordinate incident response as Incident Commander, and produce executive-level reports. Support multi-agency incident ...
Cyber Incident Response Analys
Austin, TX · On-site
Perform host-based forensics, investigate security incidents, analyze threats, coordinate incident response as Incident Commander, and produce executive-level reports. Support multi-agency incident ...
Cybersecurity Incident Management Commander
$110K - $185K/yr
The Cybersecurity Enterprise Incident Commander partners closely with Cybersecurity teams, Infrastructure, Platform, Legal, Communications, and business stakeholders to ensure effective response ...
Cybersecurity Incident Management Commander
$110K - $185K/yr
The Cybersecurity Enterprise Incident Commander partners closely with Cybersecurity teams, Infrastructure, Platform, Legal, Communications, and business stakeholders to ensure effective response ...
Cybersecurity Incident Management Commander
$110K - $185K/yr
The Cybersecurity Enterprise Incident Commander partners closely with Cybersecurity teams, Infrastructure, Platform, Legal, Communications, and business stakeholders to ensure effective response ...
Cybersecurity Incident Management Commander
$110K - $185K/yr
The Cybersecurity Enterprise Incident Commander partners closely with Cybersecurity teams, Infrastructure, Platform, Legal, Communications, and business stakeholders to ensure effective response ...
Cybersecurity Incident Management Commander
Plano, TX · On-site
$110K - $185K/yr
The Cybersecurity Enterprise Incident Commander partners closely with Cybersecurity teams, Infrastructure, Platform, Legal, Communications, and business stakeholders to ensure effective response ...
Cybersecurity Incident Management Commander
Plano, TX · On-site
$110K - $185K/yr
The Cybersecurity Enterprise Incident Commander partners closely with Cybersecurity teams, Infrastructure, Platform, Legal, Communications, and business stakeholders to ensure effective response ...
Mid-Level ACC Major Incident Manager
San Antonio, TX · Hybrid
$85K - $162K/yr
Lead the coordination and command of major incidents (e.g., M1/M2 or P1/P2) impacting production systems and business services. * Assess incident severity based on business impact, urgency, and scope ...
Mid-Level ACC Major Incident Manager
San Antonio, TX · Hybrid
$85K - $162K/yr
Lead the coordination and command of major incidents (e.g., M1/M2 or P1/P2) impacting production systems and business services. * Assess incident severity based on business impact, urgency, and scope ...
The Incident Commander / Command and Control Analyst serves as the focal point during active incidents, ensuring the right teams are engaged quickly, communications are clear and timely, emergency ...
The Incident Commander / Command and Control Analyst serves as the focal point during active incidents, ensuring the right teams are engaged quickly, communications are clear and timely, emergency ...
Senior IT Management, Incident & Program Delivery Lead
Spring, TX · On-site
$103K - $103K/yr
The ideal candidate excels in incident command, infrastructure stability, and enterprise program delivery-aligning execution with the organization's strategic Plans of Record (POR) to advance ...
Senior IT Management, Incident & Program Delivery Lead
Spring, TX · On-site
$103K - $103K/yr
The ideal candidate excels in incident command, infrastructure stability, and enterprise program delivery-aligning execution with the organization's strategic Plans of Record (POR) to advance ...
Incident Commander * Safety Officer * Liaison Officer * Public Information Officer * Operation Section Chief * Planning Section Chief * Logistics Section Chief * Finance Section Chief * Unit Leader ...
Incident Commander * Safety Officer * Liaison Officer * Public Information Officer * Operation Section Chief * Planning Section Chief * Logistics Section Chief * Finance Section Chief * Unit Leader ...
Incident Commander * Safety Officer * Liaison Officer * Public Information Officer * Operation Section Chief * Planning Section Chief * Logistics Section Chief * Finance Section Chief * Unit Leader ...
Incident Commander * Safety Officer * Liaison Officer * Public Information Officer * Operation Section Chief * Planning Section Chief * Logistics Section Chief * Finance Section Chief * Unit Leader ...
Incident Manager Lead - ACC Commander
San Antonio, TX · On-site +1
This role provides centralized command, coordination, escalation, and communication to ensure rapid restoration of service while minimizing business disruption. Aligned to ITIL 4 Incident Management ...
Incident Manager Lead - ACC Commander
San Antonio, TX · On-site +1
This role provides centralized command, coordination, escalation, and communication to ensure rapid restoration of service while minimizing business disruption. Aligned to ITIL 4 Incident Management ...
As the Business Command Center (BCC) Major Incident/Cyber Lead, you will play a critical role in ensuring the stability and resilience of Citi's Services business organization globally. Leading ...
As the Business Command Center (BCC) Major Incident/Cyber Lead, you will play a critical role in ensuring the stability and resilience of Citi's Services business organization globally. Leading ...
Public Safety Liaison
San Antonio, TX · On-site
$69K - $71K/yr
FEMA Independent Study Incident Command System 100; Introduction to the Incident Command System * FEMA Independent Study Incident Command System 200; Basic Incident Command System for Initial ...
Public Safety Liaison
San Antonio, TX · On-site
$69K - $71K/yr
FEMA Independent Study Incident Command System 100; Introduction to the Incident Command System * FEMA Independent Study Incident Command System 200; Basic Incident Command System for Initial ...
Serve as the primary incident commander working closely with management during major security events, coordinating activities between Security Operations, Infrastructure, Identity & Application teams.
Serve as the primary incident commander working closely with management during major security events, coordinating activities between Security Operations, Infrastructure, Identity & Application teams.
Public Safety Liaison (Austin, TX)
Austin, TX · On-site
$89K - $93K/yr
FEMA Incident Command System 300; Intermediate ICS for Expanding Incidents * FEMA 700; An Introduction to the National Incident Management System * 5+ years of experience in emergency management ...
Public Safety Liaison (Austin, TX)
Austin, TX · On-site
$89K - $93K/yr
FEMA Incident Command System 300; Intermediate ICS for Expanding Incidents * FEMA 700; An Introduction to the National Incident Management System * 5+ years of experience in emergency management ...
Incident Command information
What are the key skills and qualifications needed to thrive as an Incident Commander, and why are they important?
What are some common challenges faced by professionals in Incident Command roles, and how can they be managed effectively?
What is the difference between Incident Command vs Firefighter?
| Aspect | Incident Command | Firefighter |
|---|---|---|
| Required credentials | Emergency management training, certifications like ICS, NIMS | Firefighter certification, EMT/paramedic licenses |
| Work environment | Command centers, incident sites, coordination roles | Fire scenes, rescue operations, emergency response |
| Employer & industry usage | Emergency management agencies, fire departments, disaster response teams | Fire departments, rescue services, emergency response units |
Incident Command and Firefighter roles often overlap during emergencies, but Incident Command focuses on managing and coordinating the response, while Firefighters are directly involved in suppression and rescue efforts. Both roles require specialized training and are essential in emergency situations, but their responsibilities and work environments differ significantly.
What is Incident Command?

Full-time
Medical, Dental, Vision, Life, Retirement, PTO
Posted yesterday
Thomson Reuters rating
8.9
Based on 19 frontline employees who took The Breakroom Quiz
32nd of 487 rated business services
Job description
Senior Manager, AIOps and Major Incident Orchestration
Are you ready to help transform how Thomson Reuters detects, orchestrates, and resolves critical technology incidents through AI-driven operations?
At Thomson Reuters, we build technology that helps professionals pursue justice, truth, and transparency. As we continue evolving toward AI-enabled, automation-first operations, we are expanding our Major Incident Management function.
About the role
We are seeking aSenior Manager, AIOps and Major Incident Orchestrationto serve as a senior escalation point and incident command leader while driving the design and implementation of enterprise-wide AIOps and orchestration capabilities.
This is asenior individual contributor rolefocused on high-priority enterprise service disruptions -not cybersecurity incident response. The role sits at the intersection of real-time incident command and intelligent automation, combining hands-on leadership during the enterprise's most critical moments with the strategic work of modernizing how we respond to and prevent Major Incidents.
Act as a senior escalation point for high-severity Major Incidents, providing command-and-control leadership across multiple technical teams.
Drive clarity, pace, and accountability during complex or high-impact incidents, ensuring consistent adherence to incident management standards, communication cadence, and executive update protocols.
Participate in a weekend on-call rotation, providing coverage for your assigned time zone.
Design and implement incident orchestration workflows that reduce manual effort and accelerate resolution across the incident lifecycle.
Partner with engineering and platform teams to deploy automation, intelligent routing, event correlation, and alert noise reduction using AIOps and enterprise service management platforms such as ServiceNow.
Introduce modern incident management practices, including intelligent runbooks, automation playbooks, and self-healing patterns, helping shift the organization from reactive response to proactive detection and prevention.
Build and maintain strong relationships with engineering, infrastructure, SRE, and application support teams, serving as a trusted partner during incidents and post-incident reviews.
Collaborate with global Major Incident Management leads to ensure consistent orchestration, seamless handoffs, and alignment across regions and time zones.
Communicate effectively with senior leadership under pressure, providing clear, concise updates on incident status, business impact, and resolution progress.
Analyze incident and alert data to identify trends, noise, and improvement opportunities, driving measurable improvements in MTTR, incident data quality, and automation adoption.
Lead and support post-incident reviews, root cause analysis follow-ups, and lessons-learned sessions to enhance the maturity of the Major Incident Management practice.
You're a strong fit for the role ofSenior Manager, AIOps and Major Incident Orchestrationif your background includes:
7+ years of progressive experience in IT operations, incident management, technology service management, or a related discipline.
3+ years in a senior individual contributor or people leadership role within a global enterprise environment.
Bachelor's degree in Computer Science, Information Technology, Engineering, or a related field - or equivalent professional experience.
Proven ability to lead incident bridges and command high-pressure situations with composure, structure, and executive presence.
Deep understanding of ITIL-based incident management practices and enterprise service management tools such as ServiceNow.
Strong experience partnering with engineering, infrastructure, SRE, platform, and application support teams across complex, distributed technology environments.
Exceptional communication and stakeholder management skills, including the ability to brief executive leadership under pressure and influence without direct authority.
Analytical mindset with a focus on metrics, data-driven decision-making, and continuous improvement.
Hands-on experience with AIOps, observability, or automation platforms such as Datadog, Dynatrace, Splunk, PagerDuty, BigPanda, or Moogsoft.
Experience with incident orchestration tools such as Incident.io, FireHydrant, Rootly, or ServiceNow automation/workflow capabilities.
Familiarity with cloud-native environments, including AWS, Azure, or GCP, and microservices architectures.
Experience supporting or working alongside Site Reliability Engineering, platform engineering, or DevOps teams.
ITIL 4 Foundation or Managing Professional certification.
Interest in or exposure to AI/ML applications in IT operations, including LLM-powered tooling, agentic automation, or AI copilot integrations.
#LI-LP2
What's in it For You?
Hybrid Work Model: We've adopted a flexible hybrid working environment (2-3 days a week in the office depending on the role) for our office-based roles while delivering a seamless experience that is digitally and physically connected.
Flexibility & Work-Life Balance: Flex My Way is a set of supportive workplace policies designed to help manage personal and professional responsibilities, whether caring for family, giving back to the community, or finding time to refresh and reset. This builds upon our flexible work arrangements, including work from anywhere for up to 8 weeks per year, empowering employees to achieve a better work-life balance.
Career Development and Growth: By fostering a culture of continuous learning and skill development, we prepare our talent to tackle tomorrow's challenges and deliver real-world solutions. Our Grow My Way programming and skills-first approach ensures you have the tools and knowledge to grow, lead, and thrive in an AI-enabled future.
Industry Competitive Benefits: We offer comprehensive benefit plans to include flexible vacation, two company-wide Mental Health Days off, access to the Headspace app, retirement savings, tuition reimbursement, employee incentive programs, and resources for mental, physical, and financial wellbeing.
Culture: Globally recognized, award-winning reputation for inclusion and belonging, flexibility, work-life balance, and more. We live by our values: Obsess over our Customers, Compete to Win, Challenge (Y)our Thinking, Act Fast / Learn Fast, and Stronger Together.
Social Impact: Make an impact in your community with our Social Impact Institute. We offer employees two paid volunteer days off annually and opportunities to get involved with pro-bono consulting projects and Environmental, Social, and Governance (ESG) initiatives.
Making a Real-World Impact:We are one of the few companies globally that helps its customers pursue justice, truth, and transparency. Together, with the professionals and institutions we serve, we help uphold the rule of law, turn the wheels of commerce, catch bad actors, report the facts, and provide trusted, unbiased information to people all over the world.
About Us
Thomson Reuters informs the way forward by bringing together the trusted content and technology that people and organizations need to make the right decisions. We serve professionals across legal, tax, accounting, compliance, government, and media. Our products combine highly specialized software and insights to empower professionals with the data, intelligence, and solutions needed to make informed decisions, and to help institutions in their pursuit of justice, truth, and transparency. Reuters, part of Thomson Reuters, is a world leading provider of trusted journalism and news.
We are powered by the talents of 26,000 employees across more than 70 countries, where everyone has a chance to contribute and grow professionally in flexible work environments. At a time when objectivity, accuracy, fairness, and transparency are under attack, we consider it our duty to pursue them. Sound exciting? Join us and help shape the industries that move society forward.
As a global business, we rely on the unique backgrounds, perspectives, and experiences of all employees to deliver on our business goals. To ensure we can do that, we seek talented, qualified employees in all our operations around the world regardless of race, color, sex/gender, including pregnancy, gender identity and expression, national origin, religion, sexual orientation, disability, age, marital status, citizen status, veteran status, or any other protected classification under applicable law. Thomson Reuters is proud to be an Equal Employment Opportunity Employer providing a drug-free workplace.
Thomson Reuters makes reasonable accommodations for applicants with disabilities, including veterans with disabilities, and for sincerely held religious beliefs in accordance with applicable law. If you reside in the United States and require an accommodation in the recruiting process, you may contact our Human Resources Department atHR.Leave-Expert@thomsonreuters.com. Disability accommodations in the recruiting process may include things like a sign language interpreter, making interview rooms accessible, providing assistive technology, or other relevant accommodations. Please note this email is not intended for general recruitment questions and we will promptly respond to inquiries regarding accommodations. More information on requesting an accommodation here.
Learn more on how to protect yourself from fraudulent job postings here.
More information about Thomson Reuters can be found on thomsonreuters.com
What Thomson Reuters employees say
Pay
Benefits
Hours and flexibility
Workplace
Get the full story on Breakroom