Principal Security Engineer - Incident Response

At F5, we strive to bring a better digital world to life. Our teams empower organizations across the globe to create, secure, and run applications that enhance how we experience our evolving digital world. We are passionate about cybersecurity, from protecting consumers from fraud to enabling companies to focus on innovation. Everything we do centers around people. That means we obsess over how to make the lives of our customers, and their customers, better.

And it means we prioritize a diverse F5 community where each individual can thrive.

Principal Security Engineer – Incident Response & Crisis Management Organization: F5 Office of the CISO | Application Delivery, Security, and AI Resilience Eligibility: U.S. Citizenship Required (FedRAMP Authorization & Compliance)
Position Summary We are seeking a Principal Security Engineer / Incident Response Lead to serve as the Incident Commander and strategic program lead within the Office of the CISO. In this senior role, you will orchestrate enterprise-scale response efforts, drive cyber crisis management, and elevate incident response maturity across F5’s corporate infrastructure, hybrid multicloud environments, core product lines (BIG-IP, NGINX, Distributed Cloud, WAAP), and emerging AI-enabled services.

You will act as the primary escalation point during high-impact security events, translating complex forensic investigations into clear executive communications and driving cross-functional alignment across Engineering, SRE, Legal, Communications, and Executive Leadership.

Key Responsibilities Incident Command & Cyber Crisis Leadership Serve as the Incident Commander for enterprise-wide, high-severity cyber and product security incidents from detection through post-incident review.

Define and lead response work streams, coordinate cross-functional teams, and maintain executive visibility throughout crisis resolution.

On-Call Availability:
Participate in and lead the rotating 24/7 on-call escalation rotation for major security incidents.

IR Program Strategy & AI Security Readiness Own and evolve F5’s global Incident Response roadmap, playbooks, severity matrix, governance standards, and executive metrics.

Architect incident response frameworks for AI-enabled applications, LLMs, AI gateways, APIs, and model runtime data paths.

Drive AI-assisted security operations, automated triage, and response orchestration to eliminate manual overhead.

Executive Stakeholder & Regulatory Engagement Author high-impact technical summaries, root-cause analyses (RCAs), customer notifications, and board-level briefing materials.

Represent the Incident Response program in compliance audits, regulatory reviews, and key customer escalations.

Operational Resilience, Metrics & Mentorship Define and track key resilience metrics (MTTD, MTTC, MTTR, blast-radius reduction) and conduct high-fidelity tabletop simulations.

Mentor security engineers and incident responders, establishing technical standards, investigation playbooks, and operational best practices.

Qualifications & Requirements Citizenship & Compliance (Mandatory)
Must be a U.S. Citizen (required to support F5’s FedRAMP authorization, federal compliance mandates, and government-regulated environments).Experience & Availability
10+ years of progressive cybersecurity experience with deep expertise in Incident Command, SOC leadership, Threat Hunting, Product Security, or Digital Forensics in large-scale SaaS/cloud environments.

Willingness and availability to participate in a rotating 24/7 on-call escalation schedule.

Technical Mastery Advanced understanding of application delivery architectures, load balancing, reverse proxies, WAF/WAAP, API gateways, DDoS mitigation, and Kubernetes ingress security.

Proven expertise…