> Markdown version of [/jobs/ext/3115135-lead-senior-security-engineer-incident-response-csirt-cloud-security](https://www.wearedevelopers.com/jobs/ext/3115135-lead-senior-security-engineer-incident-response-csirt-cloud-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Lead/ Senior Security Engineer- Incident Response - CSIRT - Cloud Security

- **Company:** Fair Isaac Corporation
- **Location:** United States (Remote available)
- **Experience:** Expert
- **Salary:** $136,500.0 - $214,500.0
- **Contract:** Permanent contract
- **Skills:** Artificial Intelligence, Amazon Web Services, Cloud Computing Security, Cyber Security, Digital Forensics, Forensics Tools (Digital Forensics Software), Security Information and Event Management
- **Published:** September 27, 2026
- **Apply:** https://www.disabledperson.com/jobs/75544508-lead-senior-security-engineer-incident-response-csirt-cloud-security

## About the Role

* In-depth experience designing and facilitating IR tabletop exercises or similar simulations, including engaging cross-functional participants and turning results into real improvements.
 * Strong interpersonal skills: calm under pressure, a skilled facilitator, a trusted relationship-builder across teams, and an effective coach and mentor.
 * Experience in enterprise incident response across the full IR lifecycle.Good working knowledge of forensics tools (such as Magnet Axiom, Velociraptor, Volatility, FTK, Autopsy) and AWS cloud security fundamentals.
 * Good understanding of cloud security and AI security concepts.
 * Must have at least one of the following certifications, or similar: GCIH, GCFA, GCFE, AWS Certified Solutions Architect, or CISSP

## Description

As a Senior/Lead Incident Response Engineer at FICO, you will lead our defensive security operations with a strong focus on people, preparedness, and cross-team readiness. You will own how FICO detects, contains, and recovers from security incidents, and build the organizational readiness that makes that possible. You will be responsible for designing and running tabletop exercises that bring stakeholders from across the business together and keep them engaged from planning through execution. If you love building trust across teams and shaping how FICO prepares for security incidents, this role is for you.

What You'll Contribute

 * Design and facilitate incident response tabletop exercises across security, IT, engineering, legal, and business teams, testing preparedness and surfacing gaps.
 * Own the full incident lifecycle: detection, triage, containment, eradication, recovery, and post-incident review.
 * Build and maintain IR plans, playbooks, and runbooks for consistent, repeatable response.
 * Partner with threat intelligence, SOC, and engineering to turn IR and exercise findings into stronger detection and controls.
 * Communicate clearly with stakeholders at all levels, during incidents and in reporting.
 * Support digital forensics investigations, apply the PICERL and NIST frameworks, and lead IR activities in cloud environments using SIEM, CSPM, and other cloud security tooling.
 * Bring an IR perspective to FICO's cloud and AI security programs and use AI and automation in IR and tabletop exercise workflows.


## Related Videos

- [Checkmate: 5 Real Incidents That Can End a Software Company](https://www.wearedevelopers.com/videos/100126-checkmate-5-real-incidents-that-can-end-a-software-company)
- [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats)
- [AI Space Factories, Hacking Self-Driving Cars & Detecting Deepfakes](https://www.wearedevelopers.com/videos/1812-ai-space-factories-hacking-self-driving-cars-detecting-deepfakes)
- [Containers in the cloud - State of the Art in 2022](https://www.wearedevelopers.com/videos/410-containers-in-the-cloud-state-of-the-art-in-2022)
- [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large)
- [Reliable scalability: How Amazon.com scales on AWS](https://www.wearedevelopers.com/videos/983-reliable-scalability-how-amazon-com-scales-on-aws)

## Related Articles

- [The Geometry of Incidents: Connecting User Impact to Architecture](https://www.wearedevelopers.com/magazine/764-the-geometry-of-incidents-connecting-user-impact-to-architecture)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Events like RSAC Get You CISOs. Developers Decide What Actually Gets Deployed.](https://www.wearedevelopers.com/magazine/693-events-like-rsac-get-you-cisos-developers-decide-what-actually-gets-deployed)
- [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking)
- [Got AI ideas but no money? Here are 10 free ways to level up your AI skills with Google Cloud](https://www.wearedevelopers.com/magazine/600-got-ai-ideas-but-no-money-here-are-10-free-ways-to-level-up-your-ai-skills-with-google-cloud)
- [Stephan Gillich - Bringing AI Everywhere](https://www.wearedevelopers.com/magazine/489-stephan-gillich-bringing-ai-everywhere)