Founding Security Lead — Detection & Incident Response

CipherData; Bellevue (WA); On-site; USD 160,000 - 190,000; Full time

Job summary

CipherData seeks a Lead Security Engineer to own the company’s security program, from product-level detections to incident response and compliance. You’ll lead a small founding team, define the ground truth for detections, and build a scalable security lakehouse that drives product security and customer trust.

The role reports to the CEO/CISO and sits in Bellevue, WA, with ownership of security posture, incident response, and SOC 2/ISO 27001 readiness.

Qualifications

• 8+ years in security engineering or detection engineering with outcomes
• Proven production detections: written, tuned, retired detections with FP trade-offs
• Deep hands-on with SIEM and security data platforms, EDR/XDR, and cloud/identity telemetry
• Strong Python and engineering codebase experience
• Incident response leadership on real intrusions with customer/executive communication
• Ability to articulate what separates a good investigation from a bad one precisely enough that it can be written down and measured

Responsibilities

• Own security lakehouse roadmap and detection platform
• Develop detection logic and correlation rules
• Curate benchmark datasets from real investigations
• Track attacker tradecraft and translate into agent capability
• Deploy and validate AIDR in customer environments; integrate feedback
• Own incident response and playbooks; manage security assessments and pen tests

Skills

Security engineering

Detection engineering

Incident response

Python

Cloud security

Tools

SIEM platforms

EDR/XDR

Cloud telemetry

CI/CD pipelines

Job description

CipherData seeks a Lead Security Engineer to own the company’s security program, from product-level detections to incident response and compliance. You’ll lead a small founding team, define the ground truth for detections, and build a scalable security lakehouse that drives product security and customer trust.

The role reports to the CEO/CISO and sits in Bellevue, WA, with ownership of security posture, incident response, and SOC 2/ISO 27001 readiness.