Senior Security Engineer, Detection & Response

Bay Area, CA · US - CA - Bay Area - Remote · 6+ years experience · Remote · Posted Oct 2, 2026

At a glance

Block’s Detection and Response Team (DART) investigates and responds to threats across products and systems.
The Computer Security Incident Response Team (CSIRT) leads complex investigations and coordinates response to security incidents across the company.

Command complex, high-impact security incidents from initial assessment through containment, recovery, and closure.
Investigate threats across endpoint, identity, cloud, SaaS, network, and application systems and drive containment and remediation with system owners.
Reconstruct timelines, preserve evidence, and determine the scope and impact of incidents.
Coordinate containment and remediation with system owners while balancing urgency and business impact.
Keep incident priorities, decisions, owners, and handoffs clear across teams and time zones.
Lead post-incident reviews and drive findings, uncertainty, and response decisions to technical teams and business partners.
Write code, queries, and automation that accelerate evidence collection, analysis, and response.
Lead post-incident reviews and drive improvements to completion.
Mentor responders and participate in the incident response on-call rotation.

6+ years of hands-on incident response and digital forensics experience.
Experience commanding major security incidents involving multiple teams and competing priorities.
Strong knowledge of attacker behavior and depth in several areas of identity, endpoint, cloud, network, or application security.
Strong SQL/database understanding and log-analysis skills, and practical programming or scripting ability, such as Python.
An established AI-assisted workflow and actively develop AI-based systems and processes that improve incident coordination and case management.
Clear communication and sound judgment when working with technical teams, executives, and sensitive information.
An engineering mindset and a track record of turning incident response lessons into lasting improvements.