Staff Security Engineer, Incident Response

Responsibilities

• Respond to security incidents as part of a distributed 24x7 operations and on-call schedule.
• Triage and respond to security events and alerts, ensuring rapid containment.
• Conduct security analysis and forensics across varied data sources to determine event timelines and impact.
• Develop incident-response solutions, tooling, automations, and agentic capabilities.
• Provide technical leadership and influence team direction.
• Communicate technical decisions through design documents and technical talks.
• Mentor junior security responders through security guidance, design reviews, and code reviews.

Requirements

• Active or current US Government Secret clearance eligibility is required; Top Secret is preferred.
• Bachelor’s degree plus 7+ years of incident-response experience, or a master’s degree plus 5+ years of incident-response experience.
• Cloud-security expertise in at least one of AWS, GCP, or Azure, with proficiency in the others.
• Proficiency in AI/LLM and agentic capabilities; experience building and operating agentic systems in a security setting is preferred.
• Broad security subject-matter expertise and expertise in several core incident-response areas such as DFIR, reverse engineering, network security, storage and access security, sandboxing, or compute security.
• Experience with enterprise security and SaaS applications.
• Working knowledge of a SIEM and SOAR.
• Experience building incident-response tooling, scripting-language skills, and experience with AI coding tools.

Benefits

• Databricks offers comprehensive benefits and perks tailored to employee needs and provides region-specific benefit details.
• US-based candidates outside the listed locations may be considered.