- Company Name
- Chainlink Labs
- Job Title
- Security Response Engineer, Incident Response
- Job Description
-
**Job Title**
Security Response Engineer, Incident Response
**Role Summary**
Own the full security incident response lifecycle in a remote, technology‑centric environment. Act as incident commander for high‑severity events, coordinate cross‑functional teams, and drive continuous improvement of detection, playbooks, and automation tooling.
**Expectations**
- Lead and resolve high‑impact incidents involving endpoint (macOS), cloud, and network environments.
- Operate on-call rotation, triage alerts, and manage incident timelines, decisions, and communications.
- Deliver clear post‑incident reports and remedial actions.
**Key Responsibilities**
- Serve as incident commander for high‑severity incidents, coordinating internal teams and external stakeholders.
- Triage inbound alerts, scope incidents, contain threats, and remediate across macOS, cloud, and network platforms.
- Create, refine, and automate detection rules (Sigma format) and playbooks.
- Conduct tabletop exercises and drive post‑mortem root‑cause analysis.
- Identify telemetry gaps, design, and deploy tooling to enhance visibility.
- Script data parsing/enrichment and simple automation in Python, Go, Rust, or similar.
- Communicate risk, impact, and trade‑offs to technical and non‑technical audiences.
**Required Skills**
- Proven incident response leadership for high‑severity events.
- Deep operational knowledge of macOS‑heavy endpoint fleets.
- Experience with triage, scoping, containment, remediation, and root‑cause analysis.
- Ability to write and tune high‑signal detections (Sigma).
- Scripting proficiency (Python, Go, Rust, or equivalent).
- Strong written and verbal communication; ability to build trust under pressure.
- Collaborative mindset with external stakeholder engagement.
**Required Education & Certifications**
- Bachelor’s degree in Computer Science, Cybersecurity, or equivalent professional experience.
- Relevant security certifications preferred (e.g., CISSP, GCIH, OSCP, Security+).