Lead Incident Response Engineer, Cloud & Threat Detection

Theblockchainassociation; San Francisco (CA); Hybrid; USD 295,000 - 347,000; Full time

Benefits offered by this job

Health insurance

Dental insurance

Vision insurance

401K

Vacation policy

Job summary

Andreessen Horowitz (a16z) is hiring a Lead Engineer, Incident Response to lead and shape the detection and response team. This hands-on role involves investigating incidents, writing detections, building automation, and developing engineers.

You will shape capabilities across cloud, SaaS, identity, and endpoint environments and protect the firm from impersonation and fraud. This role requires in-office presence 2 days a week in our San Francisco, CA office, and offers a salary range tied to

Qualifications

• 9+ years of incident response or detection experience with cloud (AWS/GCP).
• Experience leading security engineers and mentoring teams.
• Proven track record delivering measurable improvements in detection and response.

Responsibilities

• Set the detection and response roadmap, prioritizing threats that matter and measuring coverage.
• Lead and develop engineers through coaching, feedback, and reviews on investigations.
• Develop the team's ability to respond from triage through containment, eradication, and recovery.
• Maintain and test response playbooks and escalation criteria via tabletop exercises.
• Design and improve SIEM architecture and security logging across cloud/identity/endpoint.
• Run hypothesis-driven threat hunts and turn findings into detections.
• Build brand protection capabilities including takedowns of lookalike domains and fraud.
• Build AI-assisted response automation with human-oversight requirements.
• Keep stakeholders aligned and clearly communicate impact and options.
• Lead postmortems and drive corrective actions with remediation teams.
• Participate in Security team's on-call rotation.

Skills

Incident response

Detection engineering

Python

Leadership

Communication

Cross-functional

Threat hunting

Automation

Cloud security

SOAR

Tools

SIEM

KQL

Sigma

EDR

SOAR

Cloud logs

Job description

Andreessen Horowitz (a16z) is hiring a Lead Engineer, Incident Response to lead and shape the detection and response team. This hands-on role involves investigating incidents, writing detections, building automation, and developing engineers.

You will shape capabilities across cloud, SaaS, identity, and endpoint environments and protect the firm from impersonation and fraud. This role requires in-office presence 2 days a week in our San Francisco, CA office, and offers a salary range tied to