Staff Security Engineer, Incident Response

Databricks is hiring a Staff Security Engineer to strengthen its Security Incident Response (IR) organization. As an individual contributor on the IR team, you will support high-priority incident handling across a distributed 24x7 operations and on-call schedule, combining incident response, analysis, and forensics with automation and emerging AI-driven capabilities.

This role emphasizes technical leadership during active events, as well as longer-term improvements to how the team detects, triages, and responds to security events across modern cloud and enterprise environments.

Responsibilities

• Respond to incidents as part of a distributed 24x7 operations and on-call schedule.
• Triage and respond to security events and alerts, driving quick and effective containment.
• Conduct analysis and forensics across a range of data sources to determine event timelines and impact.
• Provide technical leadership and influence team direction.
• Develop solutions leveraging AI and agentic platforms to deliver autonomous capabilities, expedite your work, and scale team impact.
• Communicate technical decisions through design docs and tech talks.
• Mentor junior security responders using security guidance, design reviews, and code reviews.

Requirements

• Active or current US GOV Secret clearance eligibility; Top Secret preferred.
• Bachelor's Degree and 7+ years of Incident Response experience, or a Master's Degree and 5+ years of Incident Response experience.
• Cloud security expertise in at least one of AWS, GCP, or Azure, with proficiency in the others.
• Proficiency in AI/LLM and agentic capabilities, with preference for experience building and operating agentic systems in a security setting.
• Broad security subject matter expertise.
• Expertise in core incident response skills such as DFIR, Reverse Engineering, Traditional Network Security, Storage and access security, Sandboxing, and Compute security.
• Experience with Enterprise Security and SaaS applications.
• Working knowledge of SIEM and SOAR.
• Experience building incident response tooling, scripting language skills, and experience with AI coding tools.

Technologies

• AWS, GCP, Azure
• AI, LLM, agentic platforms
• SIEM, SOAR
• DFIR, Reverse Engineering, Sandboxing