Staff Security Engineer, Incident Response
About this role
The Incident Response team at Databricks builds near-real-time log analytics, alerting, and forensics capabilities using the company's own platform to protect customers, employees, and enterprise data. Staff members operate as individual contributors reporting to the regional incident response manager, focusing on security analysis, high-priority alert handling, and the creation of automations and agentic solutions. This role exists to scale security operations across the organization while providing technical leadership and mentorship.
Candidates joining this team will participate in a distributed 24x7 operations and on-call schedule, triage security events, and build custom incident response tooling. Successful professionals typically combine deep cloud security expertise with proficiency in AI and large language models, allowing them to develop autonomous capabilities that expedite investigations. Those who thrive here are self-directed technical multipliers comfortable sharing knowledge through design documents, technical talks, and code reviews.
What you will do
- Respond to security incidents as part of a distributed 24x7 operations and on-call schedule.
- Triage and respond to security events and alerts to ensure quick and effective containment.
- Conduct analysis and forensics across various data sources to determine timelines and impacts.
- Provide technical leadership and influence team direction through design docs and tech talks.
- Develop solutions, including AI and agentic platforms, to deliver autonomous capabilities.
- Mentor junior security responders through security guidance, design reviews, and code reviews.
What you need
- Hold a Bachelor's Degree with 7+ years of incident response experience or a Master's Degree with 5+ years.
- Demonstrate cloud security expertise in at least one major platform such as AWS, GCP, or Azure with proficiency in the others.
- Show proficiency in AI, LLM, and agentic capabilities within a security setting.
- Bring broad security subject matter expertise and mastery in core incident response skills.
- Possess experience with enterprise security and SaaS applications along with working knowledge of SIEM and SOAR.
- Demonstrate scripting language skills, experience building incident response tooling, and familiarity with AI coding tools.
Nice to have
- Experience with building and operating agentic systems in a security setting
Skills and tech stack
Questions candidates ask
What does the team do?
The team's mission is to respond to security threats, incidents and investigations to protect customers, employees and enterprise data in a fast, efficient and standardised manner.
What is the on-call expectation?
Staff members respond to incidents as part of a distributed 24x7 operations and on-call schedule.
What qualifications are required?
Candidates need a Bachelor's Degree with 7+ years experience in Incident Response work or a Master's Degree with 5+ years experience, alongside cloud security expertise and proficiency in AI and agentic capabilities.