Senior Security Engineer, Incident Response
The Incident Response team's mission is to effectively respond to security threats, incidents, and investigations, ensuring the protection of our customers, employees, and enterprise data. We are a close-knit group of security incident responders and handlers dedicated to executing “Security for Databricks on Databricks,” utilizing our platform to create near-real-time log analytics, alerting, and forensics.
As an individual contributor on the security Incident Response (IR) team at Databricks, you will report to the regional IR manager. Your responsibilities will include conducting security analysis and forensics, responding to high-priority alerts, and contributing to automation and agentic capabilities. Your role will amplify the team's efforts in scaling security incident response within Databricks.
The Impact You Will Have:
- Participate in a distributed 24x7 operations and on-call schedule to respond to incidents.
- Triage and respond to security events and alerts, ensuring quick and effective containment.
- Contribute to security investigations by analyzing and forensically examining various data sources to ascertain the timeline and impact of security events.
- Develop automations, including leveraging AI and agentic platforms, to enhance efficiency and scalability of team impact.
- Communicate technical decisions through design documentation and technical discussions while mentoring junior security responders with guidance on security matters, design reviews, and code assessments.
What We Look For:
- Bachelor's Degree and 4+ years of experience in Incident Response work OR Master's Degree and 2+ years of experience.
- Strong cloud security background in at least one of the following: AWS, GCP, or Azure, with working knowledge of the others.
- Familiarity with AI/LLM and agentic capabilities, including effective prompting and the use of MCP, agents, and agent skills; experience in building and operating agentic systems in a security context is preferred.
- Broad security subject matter expertise.
- Expertise in core IR skills such as DFIR, Reverse Engineering, Traditional Network Security, Storage and Access Security, Sandboxing, and Compute Security.
- Experience with Enterprise Security and SaaS applications.
- Working knowledge of SIEM and SOAR tools.
- Proficiency in building Incident Response toolsets and strong scripting language skills.
Apply online using the form below. Only applications matching the job profile will be considered.