Security Engineer, Incident Response

What you'll do

• Lead end-to-end response for high-severity cyber and product security incidents including detection, containment, and recovery.
• Drive incident command workflows and provide clear technical updates to stakeholders during active cyber events.
• Develop and execute response procedures for AI-enabled applications, LLM workflows, and API data paths.
• Implement automated triage, observability tooling, and detection rules to isolate novel threats.
• Author actionable post-incident reports, executive briefings, and customer notification materials.
• Facilitate post-incident reviews to identify systemic risks and drive preventative engineering fixes.
• Conduct tabletop exercises, purple team simulations, and playbook updates to improve response metrics.
• Participate in a scheduled, rotating 24/7 on-call roster to ensure continuous incident response readiness.

What we're looking for

• Must be a U.S. Citizen.
• 5+ years of hands-on experience in Incident Response, Security Operations (SOC), Threat Hunting, or Digital Forensics in enterprise cloud/SaaS environments.
• Willingness and ability to participate in a rotating 24/7 on-call schedule.
• Deep familiarity with application security, reverse proxies, load balancers, WAF/WAAP, API gateways, DDoS mitigation, and Kubernetes ingress security.
• Strong experience analyzing telemetry across AWS/Azure/GCP, SIEM/EDR platforms, identity systems, and network logs.
• Working knowledge of modern attack techniques (MITRE ATT&CK), API vulnerabilities, and emerging AI/LLM security risks.
• Solid understanding of incident response frameworks and standards (NIST SP 800-61, ISO 27001, SOC 2, FedRAMP, PCI-DSS).