Security Response Engineer

As a Security Response Engineer, you'll own the full security incident response lifecycle. You'll serve as incident commander - owning the high-level coordination of incidents from scoping through to recovery and post-mortem improvements. We're looking for a seasoned individual contributor who is comfortable operating across diverse environments. In addition to response efforts, you'll be heavily involved with the team's operational responsibilities (creating and refining detections, playbooks, and processes) and project work (automating response actions, improving visibility through creation and deployment of new tooling). You would help continuously improve our response capabilities and efficiency by collaborating with internal and external stakeholders across the company.

Your Impact

• Own and improve the incident response lifecycle: act as incident commander for high-severity incidents
• Join the team's on-call rotation: triage inbound alerts/escalations, coordinate internal and company-wide incidents
• Improve response readiness: create and automate playbooks, conduct tabletop exercises
• Address security telemetry gaps: improve existing or build/deploy new tools
• Increase detection quality: write and tune high-signal detections (in Sigma)
• Proactively identify and implement areas of improvement and modernization

• Proven incident response leadership: experience as the primary incident commander for high-severity security incidents involving multiple teams and external stakeholders, and can independently manage incident timelines, decisions, and communications
• Operational rigor and investigation depth: demonstrated experience with triage, scoping, containment, and remediation across endpoint, cloud, and/or network based incidents; drives root-cause analysis and post-incident action items to completion.
• Experience in macOS-heavy environments: has secured and operated a predominantly macOS endpoint fleet: deploying / managing endpoint controls, telemetry collection, and performing investigations on macOS systems.
• Collaborative, straightforward communicator: writes clear incident updates and summaries; can explain risk, impact, and trade-offs to both technical and non-technical stakeholders; builds trust with partner teams during high-pressure situations; comfortable handling the regular communication cadence of an incident
• Detections experience: ability to create and refine detections based on investigations and threat intelligence
• Previous coding experience (Python, Go, Rust, or similar): scripting for data parsing/enrichment and simple automations

Preferred Requirements

• Prior success in remote-first environments.
• Experience with detections-as-code (Sigma) development and workflows.
• Domain experience with blockchain/Web3 threats.
• Open-source contributions to security related projects.

Chainlink is the industry-standard oracle platform bringing the capital markets onchain and powering the majority of decentralized finance (DeFi). The Chainlink stack provides the essential data, interoperability, compliance, and privacy standards needed to power advanced blockchain use cases for institutional tokenized assets, lending, payments, stablecoins, and more. Since inventing decentralized oracle networks, Chainlink has enabled tens of trillions in transaction value and now secures the vast majority of DeFi. Many of the world's largest financial services institutions have also adopted Chainlink's standards and infrastructure, including Swift, Euroclear, Mastercard, Fidelity International, UBS, S&P Dow Jones Indices, FTSE Russell, WisdomTree, ANZ, and top protocols such as Aave, Lido, GMX and many others. Chainlink leverages a novel fee model where offchain and onchain revenue from enterprise adoption is converted to LINK tokens and stored in a strategic Chainlink Reserve. Learn more at chain.link.