Lead Cybersecurity Incident Response Engineer

CoreWeave; Bellevue (WA); On-site; USD 139,000 - 204,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

Company-paid Life Insurance

Flexible PTO

401(k) match

Tuition Reimbursement

Employee Stock Purchase Program

Job summary

CoreWeave is seeking a senior security incident responder to lead our most critical cybersecurity incidents from end to end. You will hunter threats across cloud, endpoint, identity, and network data, translate complex events for senior leadership, and author deep-dive post-incident reviews to harden defenses.

You’ll drive a proactive IR program, shape response playbooks, and build AI-powered tooling to accelerate detection and containment.

Qualifications

• Extensive experience in incident response, security operations, and/or threat hunting at scale, with ownership of complex incidents from start to finish.
• Strong technical investigation and hunting skills—hands-on with logs, telemetry, and raw system data to form and validate hypotheses.
• Deep familiarity with attacker TTPs across cloud, endpoint, identity, and network environments.
• Experience briefing senior leadership during active incidents with clarity and composure.
• Ability to lead across organizational boundaries while maintaining ownership of outcomes.
• Proficiency in at least one query language (SQL, Splunk Query Language, HiveQL).
• Ability to script or automate in Python, Go, or similar to close gaps and accelerate workflows.

Responsibilities

• Lead the most complex, high-severity cybersecurity incidents end-to-end with full ownership of outcomes.
• Form hypotheses from smoke and develop strategies to attack threats before they surface.
• Serve as a credible voice to senior leadership during active incidents.
• Conduct deep investigations across endpoint, cloud, identity, and network data sources.
• Produce rigorous post-incident reviews with durable improvements.
• Run a structured threat hunting program informed by intelligence and turn findings into actions.
• Architect and build AI-powered tooling to improve threat detection and response.
• Develop incident simulations and tabletop exercises to stress-test response capabilities.

Skills

Incident response

Security operations

Threat hunting

Leadership

Query language

Scripting (Python/Go)

Tools

Splunk

HiveQL

SQL

Python

Go

Kubernetes

Job description

CoreWeave is seeking a senior security incident responder to lead our most critical cybersecurity incidents from end to end. You will hunter threats across cloud, endpoint, identity, and network data, translate complex events for senior leadership, and author deep-dive post-incident reviews to harden defenses.

You’ll drive a proactive IR program, shape response playbooks, and build AI-powered tooling to accelerate detection and containment.