Principal Security Engineer, Incident Response

What you'll do

• Serve as the Incident Commander for high-severity cyber and product security incidents from detection through post-incident review.
• Lead 24/7 on-call escalation rotations to manage major security incidents across corporate and product environments.
• Develop and maintain global incident response playbooks, severity matrices, and governance standards.
• Architect incident response frameworks specifically for AI-enabled applications, LLMs, and API gateways.
• Translate complex forensic investigations into technical summaries and reports for executive leadership and board members.
• Represent the Incident Response program during compliance audits and regulatory reviews to ensure FedRAMP requirements are met.
• Track key resilience metrics such as MTTD and MTTR while conducting high-fidelity tabletop simulations.
• Mentor security engineers by establishing technical standards and investigation best practices.

What we're looking for

• Must be a U.S. Citizen for FedRAMP authorization and government compliance requirements.
• 10+ years of progressive cybersecurity experience in Incident Command, SOC leadership, Threat Hunting, Product Security, or Digital Forensics.
• Willingness to participate in a rotating 24/7 on-call escalation schedule.
• Advanced knowledge of application delivery architectures, load balancing, WAF/WAAP, API gateways, and Kubernetes ingress security.
• Proven expertise investigating telemetry across AWS/Azure/GCP, SIEMs, EDR platforms, identity providers, and network devices.
• Working knowledge of MITRE ATT&CK, API attack vectors, and emerging AI/LLM threat landscapes.
• Ability to influence senior engineering and executive stakeholders during high-stress situations.
• Familiarity with industry frameworks including FedRAMP, NIST SP 800-61/800-53, ISO 27001, SOC 2, and PCI-DSS.