Lead Incident Response for Frontier AI Infrastructure

Fluidstack; Seattle (WA); On-site; USD 330,000 - 380,000; Full time

Job summary

Fluidstack in Seattle, WA is seeking a Senior Security Incident Response Lead to secure frontier compute infrastructure and drive end-to-end IR across corporate, cloud, and data center environments. You will build detection logic and response playbooks, run investigations across cloud, endpoint, network, and physical systems, and define severity models with on-call rotations.

The role centers on owning the IR program, delivering permanent improvements, and collaborating with security and IT

Qualifications

• What we look for includes leading major security incidents from first alert to resolution under pressure.
• Experience building detection logic and response playbooks that caught real intrusions.
• Proven digital forensics across cloud, endpoint, and network evidence.
• Ability to stand up or rebuild an incident response program end-to-end.
• Proactive threat hunting and identifying activity missed by existing tooling.
• Clear incident reporting and postmortems for engineers and executives.

Responsibilities

• Lead incident response end to end across corporate, cloud, and data center environments.
• Build detection logic, response playbooks, and forensic tooling for high-value assets.
• Run investigations across cloud, endpoint, network, and physical systems to map attacks.
• Stand up the incident response function, define severity models, on-call rotations, and escalation.
• Turn incidents into permanent improvements by partnering with security and IT teams.

Skills

Incident response leadership

Threat hunting

Digital forensics

Detection engineering

SIEM/SOAR experience

Cloud security

Stakeholder communication

Job description

Fluidstack in Seattle, WA is seeking a Senior Security Incident Response Lead to secure frontier compute infrastructure and drive end-to-end IR across corporate, cloud, and data center environments. You will build detection logic and response playbooks, run investigations across cloud, endpoint, network, and physical systems, and define severity models with on-call rotations.

The role centers on owning the IR program, delivering permanent improvements, and collaborating with security and IT