About Ping Identity:
At Ping Identity, we believe in making digital experiences both secure and seamless for all users, without compromise. We call this digital freedom. And it's not just something we provide our customers. It's something that inspires our company. People don't come here to join a culture that's built on digital freedom. They come to cultivate it.
Our intelligent, cloud identity platform lets people shop, work, bank, and interact wherever and however they want. Without friction. Without fear.
While protecting digital identities is at the core of our technology, protecting individual identities is at the core of our culture. We champion every identity. One of our core values, Respect Individuality, reminds us to celebrate differences so you are empowered to bring your authentic self to work.
We're headquartered in Denver, Colorado and we have offices and employees around the globe. We serve the largest, most demanding enterprises worldwide, including more than half of the Fortune 100. At Ping Identity, we're changing the way people and businesses think about cybersecurity, digital experiences, and identity and access management.
As a Ping Incident Escalations Coordinator, you will provide Level 2 incident response and escalation support within the Cyber Security Engineering team. You will help coordinate complex security incidents, improve incident readiness, and ensure that lessons learned are converted into practical improvements.
This is an individual contributor role, combining technical incident response experience with strong operational coordination. You will work closely with CSE engineers and cross-functional teams to maintain momentum during incidents, support tabletop exercises, and improve our incident response capability.
You will
- Act as a Level 2 escalation point for CSE engineers during complex or high-risk security incidents
- Coordinate incident response across Cyber Security, Engineering, Infrastructure, Cloud, IT, Product, and other relevant teams
- Establish incident priorities, ownership, actions, dependencies, and communication cadence
- Support investigation, containment, eradication, recovery, and validation activities
- Maintain accurate incident timelines, decision records, action logs, and stakeholder updates
- Prepare and support cyber security tabletop exercises, including scenarios, injects, facilitation, and follow-up actions
- Develop and improve incident response playbooks, runbooks, escalation paths, and readiness procedures
- Lead or support post-incident reviews and ensure lessons learned are converted into tracked improvements
- Identify recurring response gaps, operational risks, and opportunities for automation or process improvement
- Participate in the Cyber Security Engineering on-call or escalation rota, where required
- Collaborate cross-functionally to improve incident response readiness and security outcomes
Requirements
- Experience in cyber security engineering, incident response, security operations, SRE, or technical operations
- Experience responding to or coordinating security incidents involving multiple teams
- Strong operational judgement and the ability to make decisions under pressure and with incomplete information
- Experience acting as an incident lead, technical lead, escalation point, or senior responder
- Strong written and verbal communication skills, with the ability to communicate technical risk clearly to technical and non-technical audiences
- Experience creating or improving incident response playbooks, runbooks, procedures, or post-incident reviews
- Experience conducting, facilitating, or supporting tabletop or operational readiness exercises
- Ability to influence and coordinate teams without direct reporting authority
- Experience with security investigation and response tooling, such as SIEM, EDR, cloud logging, identity telemetry, or security orchestration platforms
- Strong understanding of cloud environments, preferably AWS and/or GCP
- Understanding of enterprise and SaaS operational environments
- On-call and escalation participation is a requirement for this position
You have an advantage if:
- Experience with Google SecOps and YARA-L
- Experience with security orchestration, automation, and bespoke scripting
- Experience working with Kubernetes and Docker in development or incident response contexts
- Experience with threat intelligence, detection engineering, EDR, identity response, or cloud forensics
- Experience improving incident response maturity, operational metrics, or security operating procedures
Life at Ping:
We believe in and facilitate a flexible, collaborative work environment. We’re growing quickly, but remain true to the innovative, can-do startup values that got us here. Most importantly, we keep hiring talented, smart, fun, and genuinely nice people because that’s who we want to succeed with every day.
Here are just a few of the things that make Ping special:
- A company culture that empowers you to do your best work.
- Employee Resource Groups that create a sense of belonging for everyone.
- Regular company and team bonding events.
- Competitive benefits and perks.
- Global volunteering and community initiatives
Our Benefits:
- Generous PTO & Holiday Schedule
- Parental Leave
- Progressive Healthcare Options
- Retirement Programs
- Opportunity for Education Reimbursement
- Commuter Offset (Specific locations)
Ping is the collective sum of all our individual experiences, backgrounds and influences and we pride ourselves in growing and learning together. We are committed to building an inclusive and diverse environment where everyone’s individuality is respected and everyone has an Identity. In recruiting for new colleagues, we welcome the unique contributions you can bring and encourage you to be your best self.
We are an Equal Opportunity/Affirmative Action employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex including sexual orientation and gender identity, national origin, disability, protected Veteran Status, or any other characteristic protected by applicable federal, state, or local law.
Skills Required
- Experience in cybersecurity engineering, incident response, security operations, SRE, or technical operations
- Experience responding to or coordinating security incidents involving multiple teams
- Strong operational judgment and ability to make decisions under pressure with incomplete information
- Experience acting as an incident lead, technical lead, escalation point, or senior responder
- Strong written and verbal communication skills, including communicating technical risk to technical and non-technical audiences
- Experience creating or improving incident response playbooks, runbooks, procedures, or post-incident reviews
- Experience conducting, facilitating, or supporting tabletop or operational readiness exercises
- Ability to influence and coordinate teams without direct reporting authority
- Experience with security investigation and response tooling, such as SIEM, EDR, cloud logging, identity telemetry, or security orchestration platforms
- Strong understanding of cloud environments, preferably AWS and/or GCP
- Understanding of enterprise and SaaS operational environments
- On-call or escalation participation
- Experience with Google SecOps and YARA-L
- Experience with security orchestration, automation, and bespoke scripting
- Experience working with Kubernetes and Docker in development or incident response contexts
- Experience with threat intelligence, detection engineering, EDR, identity response, or cloud forensics
- Experience improving incident response maturity, operational metrics, or security operating procedures
Ping Identity Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Ping Identity and has not been reviewed or approved by Ping Identity.
-
Leave & Time Off Breadth — Time off is considered generous, with an unlimited PTO policy highlighted in company communications and reflected in practice across roles. Several sources also reference positive norms around taking vacation rather than a policy in name only.
-
Healthcare Strength — Health coverage is broad, including medical, dental, vision, HSA/FSA options, life and disability insurance, mental‑health support, and an EAP. Wellness extras like a monthly fitness reimbursement further strengthen the package.
-
Parental & Family Support — Parental leave is framed as generous for U.S. employees, with extended paid time for birth parents commonly referenced. ERGs such as Working Families and other groups reinforce a family‑supportive environment.
Ping Identity Insights
What We Do
At Ping Identity, we make it possible to trust every digital moment across customers, employees, partners, and non-human identities. Whether you're securing millions of users, fighting fraud, simplifying third-party access, or going passwordless, establishing trust shouldn’t slow you down. Our enterprise-grade identity platform is built for scale, speed, and flexibility and works seamlessly with your existing cloud, hybrid, and on-prem environments. We help you confidently embrace AI and automation with Runtime Identity, so you can continuously verify the identity, context, and intent of every AI agent and control their actions in real time. With Ping, all digital experiences start with trust. Learn more at pingidentity.com.
Why Work With Us
Identians are what make Ping an extraordinary place to work. They create our award-winning products and they’re the reason for our unique customer following.
Gallery
