Senior Security Engineer / Senior Security Engineeress

Senior Security Engineer, Incident Response

The Incident Response team at Databricks is dedicated to swiftly addressing security threats, incidents, and investigations, ensuring the protection of our customers, employees, and enterprise data in a standardized and efficient manner. Our team of expert security incident responders leverages our own platform to conduct near-real-time log analytics, alerting, and forensics, embodying the principle of “Security for Databricks on Databricks.”

As an individual contributor on the security Incident Response (IR) team, you will report to the regional IR manager. Your responsibilities will include conducting security analysis and forensics, responding to high-priority alerts, and contributing to the development of automations and agentic capabilities. In this role, you will enhance the security posture of Databricks by scaling the security incident response efforts.

The Impact You Will Have:

• Participate in a distributed 24x7 operations and on-call schedule to respond to incidents.
• Triage and respond to security events and alerts, ensuring swift and effective containment.
• Contribute to security investigations by analyzing and forensically evaluating data sources to ascertain the timeline and impact of security events.
• Develop automations, utilizing AI and agentic platforms to enhance autonomous capabilities and streamline workflows.
• Communicate technical decisions through design documentation and tech talks, while mentoring junior security responders through guidance, design reviews, and code reviews.

What We Look For:

• Bachelor's Degree and 4+ years of experience in Incident Response work, or a Master's Degree and 2+ years of experience.
• Solid cloud security expertise in at least one of the following platforms: AWS, GCP, or Azure, with familiarity in the others.
• Knowledge of AI/LLM and agentic capabilities, including effective prompting and use of MCP, agents, and agent skills. Experience in building and operating agentic systems in a security context is preferred.
• Broad understanding of security subject matter.
• Proficiency in core IR skills such as DFIR, Reverse Engineering, Traditional Network Security, and Compute Security.
• Experience with Enterprise Security and SaaS applications.
• Familiarity with SIEM and SOAR tools.
• Experience in building Incident Response tooling and proficiency in scripting languages.

Apply online using the form below. Please note that only applications matching the job profile will be considered.