Staff Security Engineer, Incident Response

Overview

The Incident Response team's mission is to respond to security threats, incidents and investigations to protect our customers, employees and enterprise data in a fast, efficient and standardised manner. We're a tight-knit team of security incident responders and incident handlers doing "Security for Databricks on Databricks", using our own platform to create near-real-time log analytics, alerting and forensics.

Responsibilities

• Respond to incidents as part of a distributed 24x7 operations and on-call schedule.
• Triage and respond to security events and alerts, ensuring quick and effective containment.
• Conduct analysis and forensics across a range of data sources to determine the timeline and impact of security events.
• Provide technical leadership and influence team direction.
• Develop solutions, including leveraging AI and agentic platforms, to deliver autonomous capabilities, expedite your work and scale the impact of the team.
• Communicate technical decisions through design docs and tech talks.
• Mentor junior security responders via security guidance, design reviews and code reviews.

Requirements

• Bachelor's Degree AND 7+ years experience in Incident Response work OR Master's Degree AND 5+ years experience.
• Cloud security expertise in at least 1 of AWS, GCP or Azure, and proficiency in the others.
• Proficiency in AI/LLM and agentic capabilities.
• Prefer experience with building and operating agentic systems in a security setting.
• Broad security subject matter expertise.
• Expertise in a few core IR skills (DFIR, Reverse Engineering, Traditional Network Security, Storage and access security, Sandboxing, Compute security, etc.).
• Experience with Enterprise Security and SaaS applications.
• Working knowledge of a SIEM and SOAR.
• Experience building Incident Response Tooling, scripting language skills and experience with AI coding tools.