Lead Incident Response Engineer — Build Detection & Response

Andreessen Horowitz; San Francisco (CA); On-site; USD 180,000 - 250,000; Full time

Job summary

Andreessen Horowitz seeks a Lead Engineer, Incident Response to lead and shape a16z's detection and response program. This hands-on role emphasizes investigations, detections, automation, and coaching engineers toward technical excellence.

You will span cloud, SaaS, identity, and endpoint environments, shaping roadmaps, tooling, threat hunting, and response practices while coordinating with IT, Legal, and Compliance. In-office presence is required two days a week in San Francisco.

Qualifications

• 9+ years in incident response or detection with cloud focus.
• Track record leading detection and response programs across cloud/SaaS/identity.
• Experience managing security engineers with coaching and performance feedback.
• Strong detection engineering skills and incident response automation.

Responsibilities

• Set the detection and response roadmap, prioritizing threats and measuring coverage.
• Lead and develop engineers through coaching, feedback, and technical reviews.
• Develop the team's ability to respond from triage through containment and recovery.
• Maintain and test response playbooks and escalation criteria.
• Design and improve SIEM architecture and security logging across cloud/identity/endpoint.
• Run threat hunts informed by threat intelligence and investigations.
• Build and improve brand protection capabilities (impersonation/fraud).
• Build AI-assisted response automation and define human approvals.
• Keep stakeholders aligned during incidents and communicate impact and options.
• Lead postmortems and drive corrective actions to completion.

Skills

Incident response leadership

Cloud incident response

Mentoring/coaching

Detection engineering

Threat hunting tooling

Tools

SIEM

EDR

MITRE ATT&CK

Playbooks

Job description

Andreessen Horowitz seeks a Lead Engineer, Incident Response to lead and shape a16z's detection and response program. This hands-on role emphasizes investigations, detections, automation, and coaching engineers toward technical excellence.

You will span cloud, SaaS, identity, and endpoint environments, shaping roadmaps, tooling, threat hunting, and response practices while coordinating with IT, Legal, and Compliance. In-office presence is required two days a week in San Francisco.