Security Engineer, Incident Response

What you'll do

• Lead end-to-end triage, containment, and resolution for high-severity cyber and product security incidents.
• Manage incident command workflows and provide technical updates to stakeholders during active cyber events.
• Develop and execute response procedures for AI-enabled applications, LLM workflows, and API data paths.
• Implement automated triage tools and detection rules to identify and isolate novel threats.
• Coordinate with cross-functional teams like Legal, Engineering, and SRE to manage crisis communications.
• Author post-incident reports, executive briefings, and customer notification materials.
• Conduct tabletop exercises, purple team simulations, and update incident response playbooks.
• Participate in a rotating 24/7 on-call schedule to ensure continuous incident response readiness.

What we're looking for

• Must be a U.S. Citizen for FedRAMP authorization and federal compliance mandates.
• 5+ years of experience in Incident Response, Security Operations (SOC), Threat Hunting, or Digital Forensics in enterprise cloud/SaaS environments.
• Ability to participate in a rotating 24/7 on-call schedule.
• Deep familiarity with application security, reverse proxies, load balancers, WAF/WAAP, API gateways, and Kubernetes ingress security.
• Experience analyzing telemetry across AWS/Azure/GCP, SIEM/EDR platforms, identity systems, and network logs.
• Working knowledge of MITRE ATT&CK, API vulnerabilities, and emerging AI/LLM security risks.
• Solid understanding of incident response frameworks including NIST SP 800-61, ISO 27001, SOC 2, FedRAMP, and PCI-DSS.