Senior Security Engineer, Detection & Response - Remote

Block; San Francisco (CA); Remote; USD 185,000 - 310,000; Full time

Benefits offered by this job

Remote work

Medical insurance

Flexible time off

Retirement savings plans

Family planning

Job summary

Block’s Detection and Response Team (DART) seeks a Senior Security Engineer to lead incident response across endpoints, cloud, network, and applications. You will drive containment, recovery, and post-incident improvements, coordinating with engineers, Legal, Privacy, and business leaders.

You’ll write automation and tooling to accelerate evidence collection and analysis, mentor responders, and participate in on-call rotations, applying strong scripting and analytics skills to strengthen our

Qualifications

• 6+ years of hands-on incident response and digital forensics experience.
• Experience commanding major security incidents involving multiple teams and competing priorities.
• Strong knowledge of attacker behavior in identity, endpoint, cloud, network, or application security.
• Strong SQL/database understanding and log-analysis skills, and practical programming or scripting ability, such as Python.
• An established AI-assisted workflow and actively develop AI-based systems and processes that improve incident coordination.
• Clear communication and sound judgment when working with technical teams, executives, and sensitive information.
• An engineering mindset and a track record of turning incident response lessons into lasting improvements.
• A need to build: developing systems and workflows that improve incident response and connect with our broader investigation, automation, and case management capabilities.

Responsibilities

• Command complex, high-impact security incidents from initial assessment through containment, recovery, and closure.
• Investigate threats across endpoint, identity, cloud, SaaS, network, and application systems and drive containment and remediation with system owners, weighing urgency, evidence preservation, and business impact.
• Reconstruct timelines, preserve evidence, and determine the scope and impact of incidents.
• Coordinate containment and remediation with system owners while balancing urgency and business impact.
• Keep incident priorities, decisions, owners, and handoffs clear across teams and time zones.
• Lead post-incident reviews and drive findings, uncertainty, and response decisions to technical teams and business partners.
• Write code, queries, and automation that accelerate evidence collection, analysis, and response. Partner with triage, detection, threat intelligence, and infrastructure teams to address missing telemetry, improve detections, and remove recurring manual work.
• Mentor responders and participate in the incident response on-call rotation.

Skills

Incident response

Digital forensics

Major incidents leadership

AI-assisted workflows

Communication

Engineering mindset

Python scripting

Data analysis

Tools

Python

SQL

Log analysis tools

Job description

Block’s Detection and Response Team (DART) seeks a Senior Security Engineer to lead incident response across endpoints, cloud, network, and applications. You will drive containment, recovery, and post-incident improvements, coordinating with engineers, Legal, Privacy, and business leaders.

You’ll write automation and tooling to accelerate evidence collection and analysis, mentor responders, and participate in on-call rotations, applying strong scripting and analytics skills to strengthen our