Staff Security Engineer, Incident Response
Databricks is a data and AI platform that lets organizations build analytics, AI agents, and applications on a unified, governed lakehouse.
Funding history
Investors
About Databricks
Data engineers, analysts, and AI teams use Databricks to process large datasets, build reliable pipelines, and train models on a single governed platform. Users can run SQL analytics, serve ML predictions in real time, and deploy AI agents grounded in enterprise data. Its open lakehouse architecture provides consistent security and governance across analytical and operational workloads.
Skills
Candidate Availability
Required and preferred rules are kept separate and reflect the wording in the original posting.
About the Role
You will be an individual contributor on the security Incident Response team, reporting to the regional IR manager. You will respond to security incidents as part of a distributed 24x7 on-call schedule, triage alerts, conduct forensics, and build AI and agentic solutions to scale the team's impact. You will also provide technical leadership and mentor junior responders.
Requirements
- Active or current US GOV Secret clearance eligibility; Top Secret preferred
- Bachelor's Degree and 7+ years Incident Response experience or Master's Degree and 5+ years
- Cloud security expertise in at least one of AWS, GCP or Azure, and proficiency in the others
- Proficiency in AI/LLM and agentic capabilities
- Broad security subject matter expertise
- Expertise in core IR skills (DFIR, Reverse Engineering, network security, storage and access security, sandboxing, compute security)
- Experience with Enterprise Security and SaaS applications
- Working knowledge of SIEM and SOAR
- Experience building Incident Response tooling, scripting and AI coding tools
Responsibilities
- Respond to incidents as part of a distributed 24x7 operations and on-call schedule
- Triage and respond to security events and alerts to ensure quick containment
- Conduct analysis and forensics across data sources to determine timeline and impact of security events
- Provide technical leadership and influence team direction
- Develop solutions leveraging AI and agentic platforms to deliver autonomous capabilities
- Communicate technical decisions through design docs and tech talks
- Mentor junior security responders via security guidance, design reviews and code reviews