Security Engineer - Incident Response [Remote]

This is a hands-on, execution-focused role. It's ideal for a practitioner who thrives in high-tempo environments and is comfortable owning end-to-end incident lifecycle responsibilities.

• Serve as Incident Commander for SIRN-related security cases, owning coordination from detection through resolution and post-incident review.


• Lead incident triage efforts, rapidly assessing scope, severity, and impact to drive prioritization and response decisions.


• Coordinate with internal AR teams and external Solana ecosystem stakeholders throughout active incident lifecycles.


• On-call availability

• Develop, tune, and triage telemetry signals relevant to SIRN use cases, including on-chain event monitoring and infrastructure-level detection.
• Identify gaps in current detection coverage and propose improvements to signal fidelity and alert quality.

• Author, maintain, and continuously improve incident runbooks tailored to SIRN scenarios.
• Ensure runbooks reflect current threat landscape, ecosystem-specific attack patterns, and lessons learned from prior incidents.

• Provide operational and logistical support to the SIRN project team, including tracking deliverables, coordinating stakeholder communications, and ensuring project milestones are met.
• Escalate to AR Engineering and Consulting leads as appropriate.
• Maintain clear documentation across all assigned workstreams.

• 3+ years of security engineering or incident response experience, with demonstrated depth in operational IR roles.
• Experience with Web3 security, blockchain incident response, or protocol-level threat analysis (Solana ecosystem experience a strong plus).
• Strong communication skills - able to convey technical findings clearly to both engineering teams and non-technical stakeholders under pressure.
• Ability to work independently and with high autonomy in a fully remote setting.
• Background in Web2 security operations (EDR, MDM, Google Workspace, or equivalent platforms).
• Familiarity with DeFi attack patterns, smart contract exploits, or on-chain forensics.

• Bachelor's or Master's degree in Computer Science, Information Security, or a related field (or equivalent practical experience).
• Proven experience as an Incident Commander or equivalent lead role in complex, fast-moving security events.
• Hands-on experience developing or tuning telemetry, detection pipelines, or monitoring systems (SIEM, on-chain alerting, or equivalent).