Lead Incident Response Engineer - Detection & SIEM Lead

a16z crypto; San Francisco (CA); On-site; USD 210,000 - 320,000; Full time

Job summary

Andreessen Horowitz (a16z) in San Francisco is hiring a Lead Engineer, Incident Response to shape detection and response capabilities. This hands-on role involves investigations, detections, automation, and mentoring team engineers.

You will build capabilities across cloud, SaaS, identity, and endpoint environments, drive threat hunting, and collaborate with Legal, Compliance, IT, and other stakeholders. In-office presence is required 2 days per week.

Qualifications

• 9+ years in incident response or detection and response.
• Experience managing security engineers while remaining technically hands-on.
• Track record of building and leading detection and response programs.
• Experience leading high-stakes incidents across cloud, SaaS, identity, and endpoint environments.
• Strong detection engineering skills, including SIEM query languages, rule formats, testing and tuning.

Responsibilities

• Lead and shape the incident response program, prioritizing threats and improving coverage.
• Coach and develop engineers through feedback and reviews while contributing to investigations.
• Lead major incidents and coordinate the organization-wide response and escalation.
• Design and tune SIEM detections and maintain response playbooks.
• Run threat hunts and translate findings into new detections and tooling.

Skills

Incident response

Cloud security

Leadership

Detection engineering

Python scripting

Threat hunting

SIEM tooling

Communication

Tools

KQL

Sigma

EDR

SOAR

Job description

Andreessen Horowitz (a16z) in San Francisco is hiring a Lead Engineer, Incident Response to shape detection and response capabilities. This hands-on role involves investigations, detections, automation, and mentoring team engineers.

You will build capabilities across cloud, SaaS, identity, and endpoint environments, drive threat hunting, and collaborate with Legal, Compliance, IT, and other stakeholders. In-office presence is required 2 days per week.