Senior Security Engineer, Detection & Response

Block; United States; Remote; USD 218,000 - 327,000; Full time

Benefits offered by this job

Remote work

Medical insurance

Flexible time off

Retirement savings plans

Family planning

Job summary

Block’s Detection and Response Team (DART) is seeking a senior security incident responder to lead complex investigations across our products and systems. You will establish what happened, determine the scope and impact, guide containment, and keep responders and stakeholders aligned.

You’ll partner with engineers, Legal, Privacy, and business leaders, and innovate by building tools, workflows, and procedures that strengthen our response.

Qualifications

• 6+ years of hands-on incident response and digital forensics.
• Experience commanding major security incidents.
• Strong knowledge of attacker behavior across identity, endpoint, cloud, network, or application security.
• Strong SQL/database understanding and log-analysis skills; scripting like Python.
• Established AI-assisted workflow and actively develop AI-based systems and processes.
• Clear communication and sound judgment when working with technical teams, executives, and sensitive information.
• Engineering mindset with a track record of turning incident response lessons into lasting improvements.
• A need to build: developing systems and workflows that improve incident response and connect with our broader investigation, automation, and case management capabilities.

Responsibilities

• Command high-impact security incidents from initial assessment through containment, recovery, and closure.
• Investigate threats across endpoint, identity, cloud, SaaS, network, and application systems and drive containment and remediation with system owners, weighing urgency, evidence preservation, and business impact.
• Reconstruct timelines, preserve evidence, and determine the scope and impact of incidents.
• Coordinate containment and remediation with system owners while balancing urgency and business impact.
• Keep incident priorities, decisions, owners, and handoffs clear across teams and time zones.
• Lead post-incident reviews and drive findings, uncertainty, and response decisions to technical teams and business partners.
• Write code, queries, and automation that accelerate evidence collection, analysis, and response. Partner with triage, detection, threat intelligence, and infrastructure teams to address missing telemetry, improve detections, and remove recurring manual work.
• Lead post-incident reviews and drive improvements to completion.
• Mentor responders and participate in the incident response on-call rotation.

Skills

Incident response

Digital forensics

Python scripting

AI-based workflows

Communication

Engineering mindset

Leadership

Tools

SQL

Log analysis

Job description

Block is one company built from many blocks, all united by the same purpose of economic empowerment. The blocks that form our foundational teams — People, Finance, Counsel, Hardware, Information Security, Platform Infrastructure Engineering, and more — provide support and guidance at the corporate level. They work across business groups and around the globe, spanning time zones and disciplines to develop inclusive People policies, forecast finances, give legal counsel, safeguard systems, nurture new initiatives, and more. Every challenge creates possibilities, and we need different perspectives to see them all. Bring yours to Block.

The Role

Block’s Detection and Response Team (DART) investigates and responds to threats across our products and systems. Within DART, the Computer Security Incident Response Team (CSIRT) leads complex investigations and coordinates the response to security incidents across the company. You’ll establish what happened, determine the scope and impact, guide containment and recovery, and keep responders and stakeholders aligned.

You’ll be a trusted resource for your peers, contributing technical judgment and direction to complex investigations and helping the team make sound decisions. You’ll partner closely with engineers, other security teams, Legal, Privacy, and business leaders. Between incidents, you’ll innovate by building the tools, workflows, and procedures that make our response stronger.

You Will

• Command complex, high-impact security incidents from initial assessment through containment, recovery, and closure.
• Investigate threats across endpoint, identity, cloud, SaaS, network, and application systems and drive containment and remediation with system owners, weighing urgency, evidence preservation, and business impact.
• Reconstruct timelines, preserve evidence, and determine the scope and impact of incidents.
• Coordinate containment and remediation with system owners while balancing urgency and business impact.
• Keep incident priorities, decisions, owners, and handoffs clear across teams and time zones.
• Lead post-incident reviews and drive findings, uncertainty, and response decisions to technical teams and business partners.
• Write code, queries, and automation that accelerate evidence collection, analysis, and response. Partner with triage, detection, threat intelligence, and infrastructure teams to address missing telemetry, improve detections, and remove recurring manual work.
• Lead post-incident reviews and drive improvements to completion.
• Mentor responders and participate in the incident response on-call rotation.

You Have

• 6+ years of hands-on incident response and digital forensics experience.
• Experience commanding major security incidents involving multiple teams and competing priorities.
• Strong knowledge of attacker behavior and depth in several areas of identity, endpoint, cloud, network, or application security.
• Strong SQL/database understanding and log-analysis skills, and practical programming or scripting ability, such as Python. You can analyze large, messy datasets and build reliable tools that improve investigations and response, both with and without AI.
• An established AI-assisted workflow and actively develop AI-based systems and processes that improve incident coordination and case management.
• Clear communication and sound judgment when working with technical teams, executives, and sensitive information.
• An engineering mindset and a track record of turning incident response lessons into lasting improvements.
• A need to build: developing systems and workflows that improve incident response and connect with our broader investigation, automation, and case management capabilities.

We’re working to build a more inclusive economy where our customers have equal access to opportunity, and we strive to live by these same values in building our workplace. Block is an equal opportunity employer evaluating all employees and job applicants without regard to identity or any legally protected class. We will consider qualified applicants with arrest or conviction records for employment in accordance with state and local laws and “fair chance” ordinances.

We believe in being fair, and are committed to an inclusive interview experience, including providing reasonable accommodations to disabled applicants throughout the recruitment process. We encourage applicants to share any needed accommodations with their recruiter, who will treat these requests as confidentially as possible.

While there is no specific deadline to apply for this role, U.S. roles are typically open for an average of 55 days before being filled by a successful candidate. Please refer to the date listed at the top of this job page for when this role was first posted.

Block takes a market-based approach to pay, and pay may vary depending on your location. U.S. locations are categorized into one of four zones based on a cost of labor index for that geographic area. The successful candidate’s starting pay will be determined based on job-related skills, experience, qualifications, work location, and market conditions. These ranges may be modified in the future.

To find a location’s zone designation, please refer to this resource. If a location of interest is not listed, please speak with a recruiter for additional information.

Zone A:

$217,800—$326,800 USD

Zone B:

$207,000—$310,400 USD

Zone C:

$196,100—$294,100 USD

Zone D:

$185,200—$277,800 USD

Use of AI in Our Hiring Process

We may use automated AI tools to evaluate job applications for efficiency and consistency. These tools comply with local regulations, including bias audits, and we handle all personal data in accordance with state and local privacy laws.

Contact us here with hiring practice or data usage questions.

Every benefit we offer is designed with one goal: empowering you to do the best work of your career while building the life you want. Remote work, medical insurance, flexible time off, retirement savings plans, and modern family planning are just some of our offering. Check out our other benefits at Block.

Block, Inc. (NYSE: XYZ) builds technology to increase access to the global economy. Each of our brands unlocks different aspects of the economy for more people. Square makes commerce and financial services accessible to sellers. Cash App is the easy way to spend, send, and store money. Afterpay is transforming the way customers manage their spending over time. TIDAL is a music platform that empowers artists to thrive as entrepreneurs. Bitkey is a simple self-custody wallet built for bitcoin. Proto is a suite of bitcoin mining products and services. Together, we’re helping build a financial system that is open to everyone.

Privacy Policy