Senior Incident Response Lead & Crisis Commander

F5; San Jose (CA); On-site; USD 182,000 - 273,000; Full time

Job summary

F5 is seeking a Principal Security Engineer to lead Incident Response and crisis management for enterprise-scale security events across hybrid multicloud environments. You will serve as the incident commander, shaping response strategy, cross-functional execution, and executive communications.

You will own the incident response program roadmap, drive AI-enabled security operations, and coordinate with Engineering, SRE, Legal, Communications, and leadership to mature IR maturity and regulatory

Qualifications

• 10+ years of progressive cybersecurity experience with incident command and SOC leadership.
• Willingness and availability to participate in a rotating 24/7 on-call escalation schedule.
• Advanced understanding of application delivery architectures, load balancing, reverse proxies, WAF/WAAP, API gateways, DDoS mitigation, and Kubernetes ingress security.
• Experience investigating complex telemetry across AWS/Azure/GCP, SIEMs, EDR platforms (e.g., CrowdStrike), identity providers, and network/edge devices.

Responsibilities

• Serve as the Incident Commander for enterprise-wide, high-severity security incidents from detection through post-incident review.
• Define and lead response workstreams, coordinate cross-functional teams, and maintain executive visibility during crisis resolution.
• On-Call Availability: participate in the rotating 24/7 escalation rotation for major security incidents.
• Own and evolve IR roadmap, playbooks, severity matrix, governance standards, and executive metrics.
• Architect IR frameworks for AI-enabled apps, LLMs, APIs, and model runtime data paths.

Skills

Incident command

SOC leadership

Threat hunting

Product security

Digital forensics

Executive communication

Leadership under pressure

Tools

CrowdStrike

SIEM

Kubernetes

AWS

Job description

F5 is seeking a Principal Security Engineer to lead Incident Response and crisis management for enterprise-scale security events across hybrid multicloud environments. You will serve as the incident commander, shaping response strategy, cross-functional execution, and executive communications.

You will own the incident response program roadmap, drive AI-enabled security operations, and coordinate with Engineering, SRE, Legal, Communications, and leadership to mature IR maturity and regulatory