Security Engineer, Incident Response

Databricks is hiring a Staff Security Engineer, Incident Response to serve as an individual contributor on its Security Incident Response team. The role centers on hands‑on security analysis and forensics, with ownership of incident response operations across a distributed 24x7 on‑call schedule.

As a senior responder, you will triage high‑priority alerts, drive containment through effective investigation, and help shape how the team builds and scales incident response capabilities using automation, AI, and agentic systems.

• Work within Databricks Security Incident Response as part of a distributed 24x7 operations and on‑call schedule.
• Respond to security events and alerts with a focus on rapid triage and effective containment
  .
• Perform analysis and forensics across multiple data sources to establish timeline and impact of security events.
• Provide technical leadership and influence team direction.
• Develop solutions leveraging AI and agentic platforms to deliver autonomous capabilities
  , expedite work, and scale team impact.
• Communicate technical decisions via design docs and tech talks
  .
• Mentor junior security responders through security guidance
  , design reviews
  , and code reviews
  .

• Must have an active or current US GOV Secret clearance eligibility
  ; Top Secret preferred.
• Bachelor’s Degree and 7+ years experience in Incident Response, or Master’s Degree and 5+ years experience.
• Cloud security expertise in at least AWS, GCP, or Azure
  , with proficiency in the others.
• Proficiency in AI/LLM and agentic capabilities
  ; preference for experience building and operating agentic systems in a security context.
• Broad security subject matter expertise
  .
• Expertise in several core IR areas such as DFIR, Reverse Engineering, Traditional Network Security, Storage and access security, Sandboxing, Compute security
  , and related skills.
• Experience with Enterprise Security and SaaS applications
  .
• Working knowledge of SIEM and SOAR
  .
• Experience building Incident Response Tooling
  , scripting language skills, and experience using AI coding tools
  .

• AWS, GCP, Azure
• AI, LLM, agentic platforms
• SIEM, SOAR
• DFIR, Reverse Engineering, Sandboxing

Location: California (onsite).
Experience level: 5+ years.
Education: Bachelor’s Degree.