Security Engineer - Incident response

ffive; Seattle (WA); On-site; USD 130,000 - 190,000; Full time

Job summary

F5 is seeking a Security Engineer III in Incident Response to bolster global incident management across cloud, product security, and customer environments. You will drive end-to-end response activities, coordinate multiple teams, and contribute to improving incident lifecycle metrics.

The role emphasizes hands-on incident handling, strong communication, and the ability to operate across regions, time zones, and complex environments in the Office of the CISO context.

Qualifications

• 5+ years of cybersecurity experience with hands-on incident response.
• Experience supporting complex incidents across SaaS, cloud, and hybrid environments.
• Strong written and verbal communication and cross-team collaboration.

Responsibilities

• Support incident response strategy, governance, playbooks, metrics, and reporting.
• Coordinate incident workstreams and maintain visibility through resolution.
• Build AI incident response capabilities and coordinate with AI teams.
• Collaborate with security, product, SRE, legal, and other stakeholders during readiness and response.
• Track KPIs and drive improvements in MTTR, observability, and response orchestration.

Skills

Incident response

Cybersecurity

Security operations

Communication

Tools

SIEM

Job description

Security Engineer III _ Incident Response

F5 Office of the CISO | Application Delivery, Security, and AI Resilience

Position Summary

We are seeking a Security Engineer III based in Poland to serve as a dedicated incident response member within F5's Office of the CISO. This role supports coordinated response efforts across global teams, helps maintain incident command structure during active events, and ensures consistent communication, documentation, and resolution tracking across F5's infrastructure, applications, products, and customer‑facing environments.

The ideal candidate brings hands‑on incident response experience, sound judgment under pressure, strong written and verbal communication, and the ability to support complex incidents from detection through post‑incident review. This role contributes to F5's incident response execution and operational maturity across corporate, cloud, product, and customer‑facing environments, including F5 BIG‑IP, NGINX, Distributed Cloud, WAAP, API security, DDoS, bot defense, hybrid multicloud, and emerging AI‑enabled services.

The role supports high‑severity cyber and product security incident response, cyber crisis coordination, workstream tracking, stakeholder communications, and post‑incident improvement. The successful candidate will partner across F5 security, product engineering, SRE, cloud operations, legal, privacy, communications, customer support, and business stakeholders to help drive timely, coordinated response outcomes across regions and time zones.

Key Responsibilities

Incident Response Program Support

Support F5's incident response strategy, governance, standards, playbooks, severity model, metrics, and executive reporting through disciplined execution and clear documentation.

Participate in end‑to‑end response for cyber and product security incidents, including preparation, detection, containment, recovery, customer impact assessment, and post‑incident learning.

Coordinate assigned incident workstreams, track decisions and actions, engage cross‑company and regional stakeholders, and maintain response visibility through resolution.

AI Security and Incident Response

Build incident response capabilities for AI‑enabled applications, models, agents, inference traffic, AI gateways, APIs, and runtime data paths secured or delivered through F5 technologies.

Collaborate with AI engineering, product security, security research, and governance teams on AI incident classification, response procedures, customer notification inputs, and recovery frameworks.

Contribute to AI‑assisted security operations, observability, automated triage, and responsible response automation across F5 environments.

Security Collaboration and Stakeholder Engagement

Contribute to security initiatives across incident response, product security, threat intelligence, application security, detection engineering, and resilience.

Coordinate security, engineering, SRE, product, legal, compliance, privacy, communications, customer support, and business teams during readiness and response activities.

Prepare clear incident updates, technical summaries, and operational inputs for leadership reviews, audits, customer escalations, partner discussions, and executive communications.

Operational Excellence

Track KPIs and KRIs for response effectiveness, vulnerability readiness, customer‑impact reduction, and product security resilience.

Support tabletop exercises, cyber simulations, product security drills, and customer‑impact response assessments.

Help improve MTTD, MTTC, MTTR, observability, fleet visibility, automation, and response orchestration across F5 environments.

Technical Execution

Provide practical technical support across cloud, identity, endpoint, application, API, Kubernetes, WAAP, DDoS, bot defense, AI security, threat hunting, vulnerability response, and digital investigations.

Share knowledge with responders and security engineers through documentation, peer support, and practical operating guidance.

Qualifications

5+ years of cybersecurity experience, including hands‑on experience in incident response, security operations, threat hunting, vulnerability response, product security, or investigations.

Demonstrated ability to support complex incident response activities in SaaS, cloud, hybrid, multicloud, and customer‑facing technology environments.

Strong knowledge of modern attack techniques, incident management, technical communications, cros