Senior Cloud IR Lead: Detection & Response

Idme; McLean (VA); On-site; USD 161,000 - 227,000; Full time

Benefits offered by this job

Medical, dental, vision

401(k) with company match

Unlimited PTO

Wellbeing and childcare discounts

Job summary

ID.me seeks a Staff Cloud Detection & Response Engineer to lead threat detection and incident response across cloud environments. You will act as a defender-first authority, guiding security decisions and advising engineering on secure-by-design practices.

You’ll work with AWS and/or GCP, Kubernetes workloads, and CI/CD surfaces to detect, investigate, and eliminate threats. You bring deep hands-on experience in cloud security, incident response, and forensics, with a focus on detection depth,

Qualifications

• Eight+ years in information security with hands-on IR, threat hunting, and forensics.
• Three+ years leading IR in cloud environments (AWS and/or GCP).
• Proficient in Python/Go/bash for detection tooling.
• Deep knowledge of IAM least-privilege design and risk controls.
• Hands-on Kubernetes (EKS/GKE) and container runtime security experience.
• Experience with immutable cloud forensics workflows and automated evidence capture.
• Ability to advise on secure-by-design architecture and CI/CD security.

Responsibilities

• Lead high-severity cloud security incidents with technical authority from detection to recovery.
• Engineer immutable cloud forensics pipelines to preserve evidence during autoscaling.
• Advise on secure cloud architecture, IAM, network perimeters, and workload identity.
• Drive visibility into CI/CD pipelines for security signals without owning pipelines.
• Conduct deep Kubernetes runtime security investigations across clusters and pods.
• Perform proactive threat hunting using cloud-native telemetry to detect IOCs and TTPs.
• Own incident command during major cloud incidents and communicate with leadership.
• Lead root-cause analyses and convert findings into architectural improvements.
• Mentor SOC/IR analysts to raise overall cloud threat detection fluency.
• Stay current on cloud-native security services and advise adoption into playbooks.

Skills

Incident response

Threat hunting

Forensic analysis

Python

Go

Bash

IAM least-privilege design

Kubernetes security

Immutable forensics workflows

CI/CD security

SIEM/EDR/DLP/IDS

Incident command

Tools

Chronicle

Splunk

Terraform

Kubernetes security tooling

Job description

ID.me seeks a Staff Cloud Detection & Response Engineer to lead threat detection and incident response across cloud environments. You will act as a defender-first authority, guiding security decisions and advising engineering on secure-by-design practices.

You’ll work with AWS and/or GCP, Kubernetes workloads, and CI/CD surfaces to detect, investigate, and eliminate threats. You bring deep hands-on experience in cloud security, incident response, and forensics, with a focus on detection depth,