Global Incident Response Lead & Threat Hunter

Mozilla Foundation; United States; Remote; USD 140,000 - 200,000; Full time

Benefits offered by this job

Performance-based bonus plans

Medical, dental, and vision coverage

Retirement contributions with 100% 1st

Quarterly all-company wellness days

Home office stipend

Professional development budget

Paid parental leave

Job summary

Mozilla Corporation is seeking an experienced security incident response lead to identify and respond to incidents globally, acting as incident commander to drive incidents through their lifecycle.

The role involves designing security alerts, automation, and escalation workflows, plus conducting threat hunting and coordinating threat intelligence workflows with stakeholders. A strong leadership presence and cross-team collaboration are essential.

Qualifications

• 5+ years of experience managing security incidents at a global scale or in SOC/PSIRT/CSIRT.
• Expertise with SIEM systems (ELK, Splunk) and cloud platforms.
• Hands-on experience with EDR tools and SOAR platforms.
• Proven ability to design and maintain security alerts, playbooks, and escalation workflows.

Responsibilities

• Identify and respond to security incidents on a global scale.
• Act as incident commander to drive incidents through the lifecycle.
• Design and maintain security alerts, automated actions, playbooks, and escalation workflows.
• Conduct threat hunting and manage threat intelligence workflows.

Skills

Security incident management

SIEM systems (ELK, Splunk)

EDR tools

SOAR platforms (Tines, Splunk SOAR)

Cloud technologies (GCP, AWS, Azure)

Software development/engineering ops

Communication & leadership

Tools

ELK

Splunk

Google BigQuery

Tines

Splunk SOAR

GCP

AWS

Azure

Job description

Mozilla Corporation is seeking an experienced security incident response lead to identify and respond to incidents globally, acting as incident commander to drive incidents through their lifecycle.

The role involves designing security alerts, automation, and escalation workflows, plus conducting threat hunting and coordinating threat intelligence workflows with stakeholders. A strong leadership presence and cross-team collaboration are essential.