Incident Handler
San Francisco · USD 133,600-200,400 · 3+ years experience · Full-time · Posted Oct 9, 2026
At a glance
- Experience
- 3+ years experience
- Employment
- Full-time
- Location
- San Francisco
- Salary
- USD 133,600-200,400
About the role
- Harvey is hiring an experienced Incident Response Handler to drive and ultimately lead incident response for security events.
- You will command incidents, coordinate containment, and enforce that real fixes are implemented, preventing recurrence.
- This is an individual contributor role within a small, highly technical security team early in standing up a dedicated Detection & Response function.
Responsibilities
- Build strong relationships with key employees across the organization
- Participate in security incidents, leading investigations across cloud infrastructure, identity systems, corporate environments, and our AI platforms
- Use, maintain, and contribute to an internally developed agentic SOC, fine tuned to Harvey’s threat environment
- Work cross functionally across technical and operational orgs, ensuring the right PRs ship and best policies are enforced
- Contribute to Harvey’s Detection & Response roadmap, including metrics, SLAs, threat modeling, and tabletop exercises for our most critical business risks
- Work across teams to ensure incident follow ups are meaningfully closed
- Mentor engineers and incident responders, build playbooks and operational standards, and raise the security bar across the company
Requirements
- 3+ years of experience in Incident Response, Detection & Response, Security Operations, Threat Detection, or related security engineering disciplines
- Experience participating in investigations and response efforts for complex security incidents in cloud-native environments
- Deep understanding of attacker tactics, techniques, and procedures (MITRE ATT&CK and modern threat actor tradecraft)
- Experience with one or more major cloud platforms (AWS, GCP, Azure), plus strong knowledge of operating systems, networking, and identity systems
- Experience building security automation and tooling, with strong scripting or software engineering skills in Python, Go, or similar languages
- Experience communicating incident status and risk to senior leadership
Skills
- Python
- Go
- AWS
- GCP
- Azure
- MITRE ATT&CK
