Sr. Security Engineer - Incident Response

F5 Networks, Inc.; Warszawa; Hybrid; PLN 260,000 - 450,000; Full time

Job summary

Senior Incident Response Lead based in Poland joins F5's Office of the CISO to direct end-to-end cyber and product security incident management across global teams. You will coordinate active incidents from detection through post-incident review, drive cross-functional workstreams, and maintain executive visibility and documentation.

The role spans hybrid multicloud environments, AI security, DDoS and API protections, with a focus on rapid containment, recovery, and continuous improvement.

Qualifications

• 7+ years of cybersecurity experience with incident response, security operations, or investigations.
• Proven ability to lead complex incident response activities across SaaS, cloud, and customer-facing tech environments.
• Strong written and verbal communication for executive audiences.
• Knowledge of application delivery and security architectures (load balancers, WAF, API security, DDoS).

Responsibilities

• Lead end-to-end cyber and product security incidents from detection to post-incident review.
• Coordinate workstreams across engineering, security, product, legal, privacy, and communications.
• Maintain executive visibility and documentation during active incidents.

Skills

Incident response leadership

Cross-functional coordination

Senior stakeholder communications

Crisis management

Threat detection & analysis

Tools

AWS

CrowdStrike

SIEM

WAF/WAAP

Job description

At F5, we strive to bring a better digital world to life. Our teams empower organizations across the globe to create, secure, and run applications that enhance how we experience our evolving digital world. We are passionate about cybersecurity, from protecting consumers from fraud to enabling companies to focus on innovation. Everything we do centers around people. That means we obsess over how to make the lives of our customers, and their customers, better. And it means we prioritize a diverse F5 community where each individual can thrive.

Senior Incident Response — Poland F5 Office of the CISO | Application Delivery, Security, and AI Resilience Position Summary

Position Summary We are seeking a senior Incident Response Lead based in Poland to serve as a dedicated incident command and response member within F5’s Office of the CISO. This role coordinates cross-functional response efforts across global teams, maintains incident command structure during active events, and ensures consistent communication, documentation, and resolution tracking across F5’s infrastructure, applications, products, and customer-facing environments.

The ideal candidate brings senior-level incident response experience, sound judgment under pressure, strong written and verbal communication, and the ability to drive complex incidents from detection through post-incident review.

This role advances F5’s incident response execution and operational maturity across corporate, cloud, product, and customer-facing environments, including F5 BIG-IP, NGINX, Distributed Cloud, WAAP, API security, DDoS, bot defense, hybrid multicloud, and emerging AI-enabled services. The role leads high-severity cyber and product security incident response, end-to-end cyber crisis management, workstream coordination, executive communications, and post-incident improvement. The successful candidate will partner across F5 security, product engineering, SRE, cloud operations, legal, privacy, communications, customer support, and business stakeholders to drive timely, coordinated response outcomes across regions and time zones.

Key Responsibilities

• Incident Response Program Leadership Support F5’s incident response strategy, roadmap, governance, standards, playbooks, severity model, metrics, and executive reporting.
• Lead end-to-end response for cyber and product security incidents, including preparation, detection, containment, recovery, customer impact assessment, and post-incident learning.
• Manage cyber crises end to end by defining workstreams, driving decisions, coordinating cross-company and regional stakeholders, and maintaining executive visibility through resolution.
• AI Security and Incident Response Build incident response capabilities for AI-enabled applications, models, agents, inference traffic, AI gateways, APIs, and runtime data paths secured or delivered through F5 technologies.
• Partner with AI engineering, product security, security research, and governance teams on AI incident classification, response procedures, customer notification inputs, and recovery frameworks.
• Advance AI-assisted security operations, observability, automated triage, and responsible response automation across F5 environments.
• Strategic Security Leadership Contribute to F5 security strategy across incident response, product security, threat intelligence, application security, detection engineering, and resilience.
• Coordinate security, engineering, SRE, product, legal, compliance, privacy, communications, customer support, and business teams during readiness and response activities.
• Represent incident response in executive reviews, audits, customer escalations, partner discussions, and board-level conversations.
• Operational Excellence Define KPIs and KRIs for response effectiveness, vulnerability readiness, customer-impact reduction, and product security resilience.
• Lead tabletop exercises, cyber simulations, product security drills, and customer-impact response assessments.
• Improve MTTD, MTTC, MTTR, observability, fleet visibility, automation, and response orchestration across F5 environments.
• Technical Leadership Provide expert guidance on cloud, identity, endpoint, application, API, Kubernetes, WAAP, DDoS, bot defense, AI security, threat hunting, vulnerability response, and digital investigations.
• Mentor and help guide learning for responders and security engineers through technical leadership, influence, and practical operating guidance.

Qualifications

• 7+ years of cybersecurity experience, including strong expertise in incident response, security operations, threat hunting, vulnerability response, product security, or investigations.
• Proven ability to lead complex incident response activities in SaaS, cloud, hybrid, multicloud, and customer-facing technology environments.
• Strong knowledge of modern attack techniques, incident management, executive communications, cross-functional crisis coordination, workstream management, and stakeholder orchestration.
• Understanding of application delivery and security architectures, including load balancing, reverse proxy, WAF, API security, DDoS protection, bot defense, Kubernetes ingress, and public cloud security.
• Experience conducting AI and security investigations using eReady, AWS, CrowdStrike, model invocation, identity and access, API gateway and application, agent/tool execution, data access and retrieval, cloud and infrastructure, EDR, SIEM, WAF/WAAP, DLP, vulnerability, threat intelligence, and network/edge logs.
• Experience influencing outcomes across distributed teams without direct authority; familiarity with NIST, ISO, SOC, PCI, and GDPR requirements preferred.
• Ability to support global incident response operations from Poland, including collaboration across LATAM / Americas time zones.

Success Measures

• Success in the first 12–18 months will be measured by supporting improved response capabilities and execution, faster detection, containment, and recovery; stronger product and AI incident readiness; reduced manual effort through automation; and effective coordination across global stakeholders.

Role Details

Senior Individual Contributor based in Poland; F5 Office of the CISO; focused on incident response execution, cyber crisis management, workstream leadership, AI security response, application/API security, hybrid multicloud resilience, customer trust, and global stakeholder engagement.

The Job Description is intended to be a general representation of the responsibilities and requirements of the job. However, the description may not be all-inclusive, and responsibilities and requirements are subject to change.

Equal Employment Opportunity

It is the policy of F5 to provide equal employment opportunities to all employees and employment applicants without regard to unlawful considerations of race, religion, color, national origin, sex, sexual orientation, gender identity or expression, age, sensory, physical, or mental disability, marital status, veteran or military status, genetic information, or any other classification protected by applicable local, state, or federal laws. This policy applies to all aspects of employment, including, but not limited to, hiring, job assignment, compensation, promotion, benefits, training, discipline, and termination. F5 offers a variety of reasonable accommodations for candidates. Requesting an accommodation is completely voluntary. F5 will assess the need for accommodations in the application process separately from those that may be needed to perform the job. Request by contacting [e-mail].

Hybrid

Employees within 30 commutable miles of an F5 office are required to work from the office a minimum of 30 business days per quarter.

Remote

Primarily work from designated home location but can come into an F5 office to work or travel to an offsite location as needed.

Together, we're building a better digital world.

Founded in 1996, F5 is a global leader in application delivery and security. Our premier platform helps customers secure and deliver every app, API, and piece of infrastructure across all environments. Backed by over three decades of expertise and 553 patents, our solutions protect against threats while ensuring fast, reliable digital experiences. With over 6,400 employees, we serve more than 23,000 customers in over 170 countries. To continue this work, we need people like you—the best minds in the industry. We're committed to a unique, human-first culture that encourages authenticity, prioritizes diversity and inclusion, and fosters the growth and success of our employees.