> Markdown version of [/jobs/ext/3420787-incident-responder](https://www.wearedevelopers.com/jobs/ext/3420787-incident-responder). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Incident Responder - **Company:** The Arkenstone Ltd - **Location:** Menlo Park, CA, United States - **Experience:** Experienced - **Contract:** Permanent contract - **Skills:** Amazon Web Services, Bash Shell, Cloud Engineering, Software Documentation, Intrusion Detection and Prevention, Python (Programming Language), Performance Tuning, Cloud Services, Anti-Phishing, Kusto Query Language, Runbook, Security Information and Event Management, SQL Databases, Scripting, Cloud Platform System, Multi-Cloud, Kubernetes, Infrastructure Automation Frameworks - **Published:** September 7, 2026 - **Apply:** https://www.wayup.com/i-j-Incident-Responder-Arkenstone-420632773279641/ ## About the Role This role operates on the frontline of the Mission Assurance Center (MAC), working alongside our MSSP to triage alerts, investigate threats, and protect internal and customer-facing environments. It is ideal for a motivated responder who wants to grow quickly in a compliance-heavy, mission-critical environment where your work directly supports the security of cleared workforces. You will execute defined tasks under direct supervision, follow established playbooks, and build the foundational skills that drive career progression within the MAC., + 3-5 years of experience in Incident Response or Detection engineering roles + Hands-on exposure to AWS Athena + Proficiency in detection engineering: alert creation and tuning - writing SQL, KQL, Sigma, or YARA rules for threat detection + Proven track record of operating large-scale systems in multi-cloud environments + Strong knowledge of cloud-native architecture, container orchestration (e.g., Kubernetes), and CI/CD pipelines + Proficient in scripting (Python, Bash, etc.) and infrastructure automation tools + Excellent problem-solving skills and a bias toward ownership and action + Familiarity with SIEM platforms + Working knowledge of incident response processes, procedures, and documentation standards. + Comfortable making decisions under pressure and leading through incidents + Working knowledge of FedRAMP or NIST 800-53 controls (preferred) + Comfortable participating in customer discussions + Clear communicator who can translate technical concepts to mixed audiences, + Drive a culture of accountability, ownership, and continuous improvement + You thrive on building meaningful relationships and helping others succeed + You understand the unique challenges that defense tech startups face, and can speak their language, + Prolonged periods of sitting at a desk and working on a computer + Must be able to lift up to 15 pounds at times + Ability to communicate effectively in written and verbal form ## Description We are seeking an Incident Responder (Remote, US) to focus on incident response, threat monitoring, and detection, supporting our federal and commercial customer base. You will identify complex security and technical compliance issues, recognize patterns and root causes, and help design innovative solutions that improve our threat monitoring and detection services. You will bring your experience with security systems and incident response - both on-premises and in cloud environments - to a team growing around supporting FedRAMP-authorized Cloud Service Providers., + Follow incident response procedures including documentation, evidence collection, and escalation to senior engineers + Execute incident response playbooks for common threat scenarios including phishing, malware, and unauthorized access + Document and track security incidents from detection through resolution and lessons learned Threat Monitoring & Detection + Own the incident management lifecycle: from detection to postmortem and root cause analysis + Monitor SIEM and security tools for alerts; perform initial triage and escalate per documented playbooks; tune and create detection SIEM alerts + Collect and correlate security data from multiple sources to distinguish true positives from noise + Monitor and analyze threat intelligence sources to detect potential security threats and vulnerabilities; implement continuous monitoring systems to ensure real-time awareness of security events + Participate in on-call rotation for after-hours security monitoring and incident response Process & Knowledge Development + Maintain and improve runbooks, knowledge base articles, and repetitive task automations + Work closely with internal engineering, development, and compliance teams to implement security measures and address compliance requirements + Stay current on industry trends, emerging threats, and changes in compliance standards to ensure ongoing effectiveness.