Staff Security Engineer, Incident Response
California · Amsterdam · 5+ years experience · Remote · Posted Oct 8, 2026
At a glance
- Experience
- 5+ years experience
- Workplace
- Remote
- Location
- California · Amsterdam
About Databricks
- Databricks is the Data and AI company. More than 20,000 organizations worldwide — including adidas, AT&T, Bayer, Block, Mastercard, Rivian, Unilever, and 70% of the Fortune 500 — rely on the Databricks Data + AI Platform to build and scale data and AI apps, analytics and agents. Headquartered in San Francisco with 30+ offices around the globe, Databricks offers a unified platform that includes Genie, Lakebase, Agent Bricks, Lakeflow, Lakehouse, and Unity Catalog. To learn more, follow Databricks on LinkedIn, X, YouTube, and Instagram.
About the role
- The Incident Response team at Databricks is a tight-knit group focused on responding to security threats, incidents, and investigations to protect customers, employees, and enterprise data.
- As an individual contributor on the security Incident Response (IR) team, you will be responsible for conducting security analysis and forensics, responding to high-priority alerts, and contributing to automations and agentic capabilities.
Responsibilities
- Respond to incidents as part of a distributed 24x7 operations and on-call schedule.
- Triage and respond to security events and alerts, ensuring quick and effective containment.
- Conduct analysis and forensics across a range of data sources to determine the timeline and impact of security events.
- Provide technical leadership and influence team direction.
- Develop solutions, including leveraging AI and agentic platforms, to deliver autonomous capabilities, expedite your work, and scale the impact of the team.
- Communicate technical decisions through design docs and tech talks.
- Mentor junior security responders via security guidance, design reviews, and code reviews.
Requirements
- Active or current US GOV Secret clearance eligibility
- Bachelor's Degree AND 7+ years experience in Incident Response work OR Master's Degree AND 5+ years experience
- Cloud security expertise in at least 1 of AWS, GCP or Azure, and proficiency in the others
- Proficiency in AI/LLM and agentic capabilities
- Broad security subject matter expertise
- Expertise in a few core IR skills (DFIR, Reverse Engineering, Traditional Network Security, Storage and access security, Sandboxing, Compute security, etc.)
- Experience with Enterprise Security and SaaS applications
- Working knowledge of a SIEM and SOAR
- Experience building Incident Response Tooling, scripting language skills, and experience with AI coding tools
Preferred qualifications
- Top Secret preferred
- Experience with building and operating agentic systems in a security setting
Benefits
- Comprehensive benefits and perks that meet the needs of all employees
Skills
- AWS
- GCP
- Azure
- AI/LLM
- DFIR
- Reverse Engineering
- SIEM
- SOAR
