35 Incident Response jobs in San Francisco
Principal Security Engineer, Threat Intelligence & Investigations
Job Viewed
Job Description
What you'll be part of:
Circle is committed to visibility and stability in everything we do. As we grow as an organization, we're expanding into some of the world's strongest jurisdictions. Speed and efficiency are motivators for our success and our employees live by our company values: High Integrity, Future Forward, Multistakeholder, Mindful, and Driven by Excellence. We have built a flexible and diverse work environment where new ideas are encouraged and everyone is a stakeholder.
Principal Security Engineer, Threat Intelligence & Investigations
What you'll be responsible for
As a Principal Security Engineer, you'll lead the blockchain component of Circle's Threat Intelligence Program-delivering actionable, refined intelligence to support critical decision-making across the business. You'll partner with teams across the organization to improve detection capabilities, respond to blockchain-focused incidents, and contribute to the broader maturity of Circle's intelligence operations. This role requires deep Web3 threat expertise, a customer-first mindset, and a strong ability to automate and scale intelligence workflows. As the sole analyst covering the US timezone, you'll play a vital role in supporting global coverage, including occasional on-call responsibilities to support security operations.
What you'll work on
- Build and manage the blockchain arm of Circle's Threat Intelligence Program
- Collaborate with product and security teams to threat model new Web3 products and enhance detections
- Monitor, triage, and assess incoming intelligence feeds and alerts
- Process Requests for Intelligence (RFIs) and provide timely, actionable insights
- Produce clear and impactful threat intelligence reports, briefings, and automated outputs
- Develop AI-driven workflows using SOAR and TIP platforms to streamline intelligence operations
- Build and maintain trusted relationships with internal stakeholders and external partners
- Contribute to the long-term strategy and maturity of Circle's Threat Intelligence Program
- Support proactive threat hunting efforts within blockchain ecosystems
What you'll bring to Circle
Core Requirements
- 7+ years of experience in cyber threat intelligence, with a focus on blockchain/Web3 threats
- Proven ability to analyze smart contract exploits, protocol vulnerabilities, and related attack techniques
- Strong intel-sharing relationships within the crypto threat intelligence community
- Deep understanding of threat actors, tactics, and the evolving cyber threat landscape
- Excellent communication skills, including written reports and executive-level briefings
- Ability to operate independently and manage competing priorities in a high-velocity environment
Preferred Requirements
- Experience designing and maintaining custom threat feeds and novel collection methods
- Vision for leveraging AI to automate intelligence collection and dissemination
- Comfortable interfacing with senior leadership and translating complex risks clearly
- Proficiency with TIPs, SOAR platforms, and scripting for automation
Circle is on a mission to create an inclusive financial future, with transparency at our core. We consider a wide variety of elements when crafting our compensation ranges and total compensation packages.
Starting pay is determined by various factors, including but not limited to: relevant experience, skill set, qualifications, and other business and organizational needs. Please note that compensation ranges may differ for candidates in other locations.
Base Pay Range: $200,000 - $257,500
We are an equal opportunity employer and value diversity at Circle. We do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status. Additionally, Circle participates in the E-Verify Program in certain locations, as required by law.
Should you require accommodations or assistance in our interview process because of a disability, please reach out to for support. We respect your privacy and will connect with you separately from our interview process to accommodate your needs.
#LI-Remote
Job No Longer Available
This position is no longer listed on WhatJobs. The employer may be reviewing applications, filled the role, or has removed the listing.
However, we have similar jobs available for you below.
Cyber Incident Response - Incident Coordinator

Posted today
Job Viewed
Job Description
We'll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.
**EY Technology:**
Technology has always been at the heart of what we do and deliver at EY. We need technology to keep an organization the size of ours working efficiently. We have 250,000 people in more than 140 countries, all of whom rely on secure technology to be able to do their job every single day. Everything from the laptops we use, to the ability to work remotely on our mobile devices and connecting our people and our clients, to enabling hundreds of internal tools and external solutions delivered to our clients. Technology solutions are integrated in the client services we deliver and is key to us being more innovative as an organization.
EY Technology supports our technology needs through three business units:
**Client Technology (CT)** - focuses on developing new technology services for our clients. It enables EY to identify new technology-based opportunities faster and pursue those opportunities more rapidly.
**Enterprise Workplace Technology (EWT)** - EWT supports our Core Business Services functions and will deliver fit-for-purpose technology infrastructure at the cheapest possible cost for quality services. EWT will also support our internal technology needs by focusing on a better user experience.
**Information Security (InfoSec)** - InfoSec prevents, detects, responds and mitigates cyber-risk, protecting EY and client data, and our information management systems.
**The opportunity**
The Cyber & Investigative Services (CIS) Incident Coordinator will exercise strong incident management techniques to coordinate security incident response to cybersecurity events or incidents stemming from suspected threats. Candidates for the role must have a strong comprehension of incident response plans and coordination of activities, work well with others, and have strong verbal and written communication skills. Including, a sense of diplomacy, ability to anticipate obstacles, and decision-making skills to handle the fast-paced world of incident management. Foundational skills in incident response, incident management, chain of custody, forensics, event analysis, and hands on cyber security skills are essential.
**Your key responsibilities**
+ Coordinate response efforts to cyber incidents caused by external threats that may involve nontraditional working hours
+ Serve as a liaison to different businesses and interface with fellow team members and colleagues on other security teams. As-needed, manage relationships with business partners, management, vendors, and external parties
+ Drive integration with other corporate incident management programs to ensure consistency and alignment with peer support teams within IT
+ Help lead small to medium sized projects as directed by leadership
+ Be a champion for process and documentation. Develop and document processes to ensure consistent and scalable response operations, and ensure continuous improvement to the company's incident response plan
+ As requested, develop and deliver metrics to leadership
+ Create ready-to-go draft communications and ensure timely reports/updates to leadership during and after an event
+ Own and manage the teams internal action playbooks and knowledgebase
+ Must be willing to be on-call off-hours in rotation with other team members (Required)
**Skills and attributes for success**
+ Resolution of security incidents by validating root cause and solutions
+ Analyze findings in investigative matters, and develop fact-based reports
+ Ability to identify and articulate opportunities for improvement while helping drive lessons learned activities
+ Demonstrated integrity and judgment within a professional environment
+ Inquisitive approach to analysis and peer review
+ Application of emotional intelligence and calm under pressure
+ Ability to appropriately balance work/personal priorities
**To qualify for the role, you must have**
**Education:**
+ Bachelors or Masters Degree in Computer Science, Information Systems, Engineering, a related field, or equivalent experience
**Experience:**
+ 7+ years' experience in at least two of the following roles:
+ Member of a Security Operations Center (SOC)
+ Security Incident Response Analyst or supporting function (2 years minimum)
+ eDiscovery or related role performing forensic functions
+ Deep understanding of security threats, vulnerabilities, and incident response
+ Understanding of electronic investigation, forensic tools, and methodologies, including: log correlation and analysis, forensically handling electronic data, knowledge of the computer security investigative processes, malware identification and analysis
+ Be familiar with a basic understanding of legalities surrounding electronic discovery and analysis
+ Understanding of regulatory stipulations regarding security incidents
+ Experience with SIEM technologies (i.e. Splunk)
+ Deep understanding of both Windows and Unix/Linux based operating systems
**Ideally, you'll also**
+ Candidates must hold or be willing to pursue related professional certifications such as GCFE, GCFA, GCIH, CISA, CISM, CISSP, or CCIM
**What we look for**
+ Demonstrated integrity in a professional environment
+ Ability to work independently
+ Have a global mind-set for working with different cultures and backgrounds
+ Knowledgeable in business industry standard security incident response process, procedures, and life-cycle
+ Excellent organizational skills and strong attention to detail
+ Excellent teaming skills
+ Excellent social, communication, and writing skills
+ Excellent customer service skills required
**What we offer you**
The compensation ranges below are provided in order to comply with United States pay transparency laws. Other geographies will follow their local salary guidelines, which may not be a direct conversion of published US salary ranges. At EY, we'll develop you with future-focused skills and equip you with world-class experiences. We'll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams. Learn more .
+ We offer a comprehensive compensation and benefits package where you'll be rewarded based on your performance and recognized for the value you bring to the business. The base salary range for this job in all geographic locations in the US is $124,400 to $32,700. The base salary range for New York City Metro Area, Washington State and California (excluding Sacramento) is 149,300 to 264,400. Individual salaries within those ranges are determined through a wide variety of factors including but not limited to education, experience, knowledge, skills and geography. In addition, our Total Rewards package includes medical and dental coverage, pension and 401(k) plans, and a wide range of paid time off options.
+ Join us in our team-led and leader-enabled hybrid model. Our expectation is for most people in external, client serving roles to work together in person 40-60% of the time over the course of an engagement, project or year.
+ Under our flexible vacation policy, you'll decide how much vacation time you need based on your own personal circumstances. You'll also be granted time off for designated EY Paid Holidays, Winter/Summer breaks, Personal/Family Care, and other leaves of absence when needed to support your physical, financial, and emotional well-being.
**Are you ready to shape your future with confidence? Apply today.**
EY accepts applications for this position on an on-going basis.
For those living in California, please click here for additional information.
EY focuses on high-ethical standards and integrity among its employees and expects all candidates to demonstrate these qualities.
**EY | Building a better working world**
EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.
Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.
EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.
EY provides equal employment opportunities to applicants and employees without regard to race, color, religion, age, sex, sexual orientation, gender identity/expression, pregnancy, genetic information, national origin, protected veteran status, disability status, or any other legally protected basis, including arrest and conviction records, in accordance with applicable law?
EY is committed to providing reasonable accommodation to qualified individuals with disabilities including veterans with disabilities. If you have a disability and either need assistance applying online or need to request an accommodation during any part of the application process, please call 1-800-EY-HELP3, select Option 2 for candidate related inquiries, then select Option 1 for candidate queries and finally select Option 2 for candidates with an inquiry which will route you to EY's Talent Shared Services Team (TSS) or email the TSS at .
Privacy Engineer, Incident Response

Posted today
Job Viewed
Job Description
Devices and Services Trust and Privacy (DSTP) is responsible for maintaining and raising the trust bar for Amazon customers across a diverse set of 30+ Devices and Services (D&S). DSTP offers horizontal services for builders to ensure trust, privacy, and accessibility is built into our products and services. We also build customer-facing capabilities that provides customers with control and transparency and reducing privacy risk, while enabling partner teams to innovate with appropriate guardrails for content moderation, privacy, accessibility, and trust.
The DSTP team is looking for a passionate Security and Privacy Incident Response Engineer who can lead the response to privacy and data protection issues across Devices & Services. You must thrive in dynamic/ambiguous situations, and think like both an attacker and defender, while working through the entire incident response lifecycle. You'll be working in a global team environment where clear and accurate communication and collaboration on privacy and data protection issues is critical.
In this role, you will apply your creative and critical problem solving skills to quickly contain incidents and then work with cross-functional teams to remediate the root cause. You must have a passion for engineering solutions to complex privacy and data governance challenges, and recognize and fill gaps in capabilities. Above all, you should be passionate about privacy, information security, the ever-changing threat landscape and privacy/security automation and tooling.
Key job responsibilities
* Manage escalated privacy and trust risk events/cases from start to finish; write detailed case notes, reports, summaries, short and long-term recommendations, and trade-off analyses for all audiences, including senior leadership.
* Interact with and influence other teams (e.g., service teams, engineering, product, legal); identify experts and stakeholders on other teams to support decisions on containing incidents or mitigating privacy and trust risks; build consensus and recommendations based on analysis of the nature of potential violations to Privacy Policies, Promises, or Legal/Regulatory requirements.
* Own successful delivery of large, impactful, and highly cross-functional program initiatives while simultaneously tracking a set of smaller projects. Demonstrate comfort with handling technical investigations and analysis, and provide actionable recommendations to senior leadership audience with minimal supervision.
* Develop deep knowledge of global privacy and data governance obligations, processes, best practices, and solutions utilized by Amazon. Utilize this knowledge to provide recommendations and consultation to improve DSTP processes and tooling and reduce risk through control automation and enhancements.
* Establish metrics and regular reporting/escalation mechanisms for measuring results, progress, and gaps in performance and compliance.
* Communicate plans, status, and critical issues clearly and effectively.
* Support deep dive assessments and ad-hoc data analysis requests.
A day in the life
This is an inherently cross-functional role where you will work directly with engineers, product managers, policy and compliance specialists, legal, PR, Marketing, and other Amazon builders to help them identify, expediently contain/mitigate privacy incidents and risks, and implement a Privacy by Design and Default culture. You will use your investigative and/or analytical experience and demonstrate your prowess and experience in writing and briefing complex cases. You will track risk assessment, validation, adjudication, and remediation actions, and ensure that teams prioritize and execute those tasks in a timely fashion. You will be responsible for knowing the ins and outs of impacted systems, and ensure the impacted builders/owners follow the correct paths to compliance. You should be comfortable working in a fast-paced, rapidly evolving environment with fast delivery time, rapid iteration, and data-driven decision-making.
About the team
This role is a part of Trust Fundamentals' Privacy GRC team within DSTP, which includes developing a set of processes, tools, and compliance mechanisms to improve leadership decision making and performance through an integrated view of how well D&S manages its unique set of privacy risks.
Our GRC team values diverse experiences. Even if you do not meet all of the qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn't followed a traditional path, or includes alternative experiences, don't let it stop you from applying.
Our team is dedicated to supporting new members. We have a broad mix of experience levels and tenures, and are building an environment that celebrates knowledge sharing and mentorship. We care about your career growth and strive to assign projects based on what will help each team member develop into a better-rounded professional and enable them to take on more complex tasks in the future.
Basic Qualifications
- Bachelor's degree in computer science or equivalent
- 5+ years of any combination of the following: threat modeling experience, secure coding, identity management and authentication, software development, cryptography, system administration and network security experience
- CCSP (Certified Cloud Security Professional) or CEH (Certified Ethical Hacker) or CFR (CyberSec First Responder) or Cloud+ or CySA+ (CompTIA Cybersecurity Analyst) or GCED (GIAC Certified Enterprise Defender) or GICSP (Global Industrial Cyber Security Professional) or PenTestPreferred Qualifications
- Experience applying threat modeling or other risk identification techniques or equivalent
- 3+ years of programming in Python, Ruby, Go, Swift, Java, .Net, C++ or similar object oriented language experience
- Experience in Security and Privacy Incident Response and proficiency in at least one of the following domains: Malware Analysis / Reverse Engineering; Digital Forensics; Security and Privacy Tool Development & Automation; Programming/Scripting; Data Protection; Identity and Access Management.
Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.
Los Angeles County applicants: Job duties for this position include: work safely and cooperatively with other employees, supervisors, and staff; adhere to standards of excellence despite stressful conditions; communicate effectively and respectfully with employees, supervisors, and staff to ensure exceptional customer service; and follow all federal, state, and local laws and Company policies. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness and professionalism, and safeguard business operations and the Company's reputation. Pursuant to the Los Angeles County Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.
Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.
Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit for more information. If the country/region you're applying in isn't listed, please contact your Recruiting Partner.
Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $136,000/year in our lowest geographic market up to $212,800/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit . This position will remain posted until filled. Applicants should apply via our internal or external career site.
Lead Incident Response Specialist
Posted 15 days ago
Job Viewed
Job Description
Key Responsibilities:
- Lead and manage the full lifecycle of security incidents, from detection and analysis to containment, eradication, recovery, and post-incident review.
- Conduct advanced forensic analysis on compromised systems, networks, and cloud environments to identify root causes, indicators of compromise (IOCs), and attack methodologies.
- Develop and implement incident response plans, playbooks, and standard operating procedures (SOPs) to enhance response capabilities.
- Utilize various security tools and technologies, including SIEM, EDR, network forensic tools, and threat intelligence platforms.
- Mentor and provide technical guidance to junior incident responders and security analysts.
- Collaborate with cross-functional teams, including IT, legal, and compliance, during incident investigations and remediation efforts.
- Prepare detailed incident reports, executive summaries, and technical documentation for internal and external stakeholders.
- Stay abreast of the latest cyber threats, attack techniques, and defensive strategies, proactively enhancing the organization's security posture.
- Participate in security assessments, vulnerability management, and penetration testing initiatives to identify weaknesses.
- Contribute to the continuous improvement of the incident response program, including automation and integration efforts.
Qualifications:
- Bachelor's degree in Computer Science, Information Security, or a related field; Master's degree preferred.
- Minimum of 7-10 years of experience in information security, with at least 4-5 years specifically in incident response or digital forensics.
- Proven experience leading complex security incident investigations and managing response efforts.
- Expertise in forensic tools (e.g., EnCase, FTK, Volatility), network analysis tools (e.g., Wireshark), and SIEM platforms (e.g., Splunk, QRadar).
- Strong understanding of common attack vectors, malware analysis, adversary tactics, techniques, and procedures (TTPs).
- Relevant certifications such as GCIH, GCFA, GNFA, OSCP, or CISSP are highly desirable.
- Excellent analytical, problem-solving, and critical thinking skills under pressure.
- Strong communication and interpersonal skills, capable of explaining complex technical issues to non-technical audiences.
- Ability to work independently and as part of a highly collaborative team.
- Experience with cloud security (AWS, Azure, GCP) incident response is a plus.
What Our Client Offers:
- Highly competitive salary and performance-based bonuses.
- Comprehensive health, dental, and vision insurance with premium coverage.
- Generous paid time off, including vacation, sick leave, and holidays.
- Robust 401(k) retirement plan with strong company matching.
- Significant opportunities for professional development, advanced certifications, and career growth.
- A challenging, fast-paced, and highly collaborative security team environment.
- Exposure to cutting-edge cybersecurity technologies and evolving threat landscapes.
- Flexible hybrid work options.
If you are a driven and expert Incident Response professional ready to tackle the most sophisticated cyber threats, we encourage you to apply. Join our client's elite team in San Francisco, California, US , and protect critical infrastructure.
Security Engineer, Detection & Incident Response
Posted 1 day ago
Job Viewed
Job Description
We are seeking highly skilled Security Engineers with a specialty in Detection and Incident Response to join our Security Engineering team. These roles are crucial in ensuring the rapid and effective response to digital security incidents across Scale. You will perform incident investigations, implement response strategies, and influence our overall incident management approach. Your expertise in digital forensics, threat hunting, malware analysis, and incident response tools will be essential in identifying and mitigating potential security threats. You will also structure complex incidents, diagnose root causes independently, and clearly explain the mechanics and significance of security breaches, including their impact and recommended remediation steps.
You will:
- Perform digital incident investigations to identify and contain potential security breaches.
- Evaluate and enhance our incident response capabilities through process improvements and detection tool implementations.
- Implement and maintain incident response playbooks and workflows.
- Perform digital forensics and malware analysis to understand attack vectors and methodologies.
- Utilize threat intelligence platforms to enhance our detection and response capabilities.
- Guide IT and security teams in implementing robust long-term solutions that improve incident prevention and response, including hunting logging or forensics gaps.
- Clearly explain the mechanics and significance of security incidents, including their potential impact and recommended remediation steps.
- Influence the incident response strategy and direction of the team, advocating for best practices and continuous improvement.
Ideally, you'd have:
- Proven experience as a Security Engineer with an emphasis on Detection Engineering, Incident Response, and Investigations.
- Proficiency in digital forensics tools and techniques.
- Strong understanding of modern cyber threats and attack methodologies.
- Production experience with SIEM and EDR tools.
- Hands-on experience with malware analysis and reverse engineering.
- Familiarity with threat intelligence platforms and their integration into incident response processes.
- The ability to structure complex incidents and diagnose root causes independently, providing actionable insights without requiring manager input.
- Excellent communication skills, with the ability to clearly present technical findings and their implications to both technical and non-technical stakeholders.
- Demonstrated ability to influence incident response strategies and drive improvements within a team.
- Relevant security certifications (e.g., GCFA, GCIA, GCIH, CISSP) are a plus.
- Experience in a senior or lead incident response role is preferred.
Scale has openings for both Senior and Mid-Level experience levels. Both are encouraged to apply for this opening.
Compensation packages at Scale for eligible roles include base salary, equity, and benefits. The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position, determined by work location and additional factors, including job-related skills, experience, interview performance, and relevant education or training. Scale employees in eligible roles are also granted equity based compensation, subject to Board of Director approval. Your recruiter can share more about the specific salary range for your preferred location during the hiring process, and confirm whether the hired role will be eligible for equity grant. You'll also receive benefits including, but not limited to: Comprehensive health, dental and vision coverage, retirement benefits, a learning and development stipend, and generous PTO. Additionally, this role may be eligible for additional benefits such as a commuter stipend.
Please reference the job posting's subtitle for where this position will be located. For pay transparency purposes, the base salary range for this full-time position in the locations of San Francisco, New York, Seattle is: $188,000—$254,400 USDPLEASE NOTE: Our policy requires a 90-day waiting period before reconsidering candidates for the same role. This allows us to ensure a fair and thorough evaluation of all applicants.
About Us:
At Scale, we believe that the transition from traditional software to AI is one of the most important shifts of our time. Our mission is to make that happen faster across every industry, and our team is transforming how organizations build and deploy AI. Our products power the world's most advanced LLMs, generative models, and computer vision models. We are trusted by generative AI companies such as OpenAI, Meta, and Microsoft, government agencies like the U.S. Army and U.S. Air Force, and enterprises including GM and Accenture. We are expanding our team to accelerate the development of AI applications.
We believe that everyone should be able to bring their whole selves to work, which is why we are proud to be an inclusive and equal opportunity workplace. We are committed to equal employment opportunity regardless of race, color, ancestry, religion, sex, national origin, sexual orientation, age, citizenship, marital status, disability status, gender identity or Veteran status.
We are committed to working with and providing reasonable accommodations to applicants with physical and mental disabilities. If you need assistance and/or a reasonable accommodation in the application or recruiting process due to a disability, please contact us at Please see the United States Department of Labor's Know Your Rights poster for additional information.
We comply with the United States Department of Labor's Pay Transparency provision .
PLEASE NOTE: We collect, retain and use personal data for our professional business purposes, including notifying you of job opportunities that may be of interest and sharing with our affiliates. We limit the personal data we collect to that which we believe is appropriate and necessary to manage applicants' needs, provide our services, and comply with applicable laws. Any information we collect in connection with your application will be treated in accordance with our internal policies and programs designed to protect personal data. Please see our privacy policy for additional information.
Incident Response Engineer (San Francisco)
Posted 2 days ago
Job Viewed
Job Description
About Us
At Cloudflare, we are on a mission to help build a better Internet. Today the company runs one of the world's largest networks that powers millions of websites and other Internet properties for customers ranging from individual bloggers to SMBs to Fortune 500 companies. Cloudflare protects and accelerates any Internet application online without adding hardware, installing software, or changing a line of code. Internet properties powered by Cloudflare all have web traffic routed through its intelligent global network, which gets smarter with every request. As a result, they see significant improvement in performance and a decrease in spam and other attacks. Cloudflare was named to Entrepreneur Magazine's Top Company Cultures list and ranked among the World's Most Innovative Companies by Fast Company.
We realize people do not fit into neat boxes. We are looking for curious and empathetic individuals who are committed to developing themselves and learning new skills, and we are ready to help you do that. We cannot complete our mission without building a diverse and inclusive team. We hire the best people based on an evaluation of their potential and support them throughout their time at Cloudflare. Come join us!
Role Summary
Team Mission
The Security Response Team's mission is to systematically respond to security threats safeguarding Cloudflare. We operate 24/7 across the globe to respond to security incidents, continuously improve our response capabilities, lead digital investigations and enhance our overall security posture. Our Cloudflare on Cloudflare, data and automation first philosophy makes us a cohesive team with high impact.
The Role
This intermediate role on the Security Response Team focuses on refining security processes and leading critical incidents-from threat detection and cyber-attack analysis to containment and forensics. This role collaborates with IT, Engineering, Product, and Legal teams to build scalable response frameworks, leveraging expertise in tooling, automation, custom log analysis, and SIEM systems. Additionally, it requires effective communication of technical topics based on business requirements and participation in a shared on-call rotation with rotating weekend and holiday shifts.
Responsibilities
Security Operations
- Oversee security event triage, validation, and response workflows, ensuring timely investigation of high-priority alerts and security anomalies.
- Collaborate with detection engineers and threat intelligence teams to refine investigative signals and improve security visibility.
- Maintain incident management processes, ensuring incidents are properly categorized, documented, and escalated as needed.
- Perform continuous operational improvements, such as tuning detection rules, optimizing log ingestion, and enhancing alert enrichment pipelines.
- Conduct security gap analysis, identifying weaknesses in monitoring coverage and recommending solutions to enhance detection and response capabilities.
- Work closely with engineering and infrastructure teams to improve log collection, normalization, and visibility across diverse environments.
- Ensure adherence to incident response playbooks, compliance standards, and security best practices (e.g., CISA, GDPR, NIST, ISO 27001).
Incident Investigation & Threat Hunting
- Lead forensic investigations into intrusions, insider threats, APTs, and account compromises.
- Perform log analysis, correlation, and anomaly detection across endpoint, network, and cloud telemetry.
- Use Python, SQL, and data engineering techniques to extract insights from large-scale logs, identifying attacker TTPs and movement across environments.
- Investigate real-time security incidents, working closely with detection teams to validate alerts and escalate threats.
- Conduct post-incident analysis to determine root causes, document findings, and recommend mitigation strategies.
Security Monitoring & Continuous Threat Analysis
- Oversee security monitoring operations, ensuring alert triage, enrichment, and validation align with investigative workflows.
- Optimize SIEM queries, log ingestion pipelines, and case management systems to improve threat visibility.
- Develop playbooks and workflows to streamline investigations and reduce manual effort in repetitive tasks.
- Maintain Standard Operating Procedures (SOPs) for effective response to security alerts and ongoing monitoring.
- Collaborate with the Detection Engineering team to refine detection rules and investigative signals based on real-world attack patterns.
Security Engineering & Automation for Investigations
- Engineer automated solutions to enhance investigation efficiency, such as log parsing scripts, data enrichment tools, and case correlation frameworks.
- Build log analysis pipelines for efficient parsing, enrichment, and correlation of multi-source security data.
- Develop custom detection logic for brute-force attempts, lateral movement, and anomaly-based intrusion detection.
- Automate threat intelligence enrichment, real-time event processing, and security data visualization.
- Engineer scalable solutions for PCAP analysis, network flow monitoring, and cloud security event detection.
Forensic Analysis & Threat Intelligence Correlation
- Perform disk, memory, and network forensics to uncover hidden indicators of compromise (IOCs) and attacker behaviors.
- Correlate multi-source logs (firewall, EDR, web, authentication logs, cloud telemetry) to reconstruct attack chains and identify attacker footholds.
- Analyze network traffic (PCAP, NetFlow, proxy logs) to detect exfiltration attempts, lateral movement, and suspicious patterns.
- Use threat intelligence APIs (e.g., VirusTotal, AbuseIPDB) to enrich investigations and automate IOC processing.
Must-Have Qualifications
- 3+ years of experience in incident response, security operations, and forensic analysis.
- Proven ability to lead crisis situations, make data-driven security decisions, and drive technical and operational improvements.
- Strong expertise in incident management, root cause analysis, and forensic investigation methodologies.
- Hands-on experience with SIEM (SQL, ELK, etc), SOAR, and EDR (CrowdStrike,) for real-time security monitoring and response.
- Expertise in cloud security (AWS, GCP, Azure) and containerized workloads (Kubernetes, Docker) security incident handling.
- Experience managing large-scale security incidents, ensuring effective escalation, resolution, and business alignment.
- Proficiency in OKR methodologies, Agile workflows, and project prioritization strategies.
- Strong understanding of threat intelligence, attacker tactics (MITRE ATT&CK), and real-world attack chains.
Nice-to-Have Qualifications
- Certifications: GCFA, GNFA, GREM, GCIH, or equivalent forensic/security certifications.
- Familiarity with SOAR platforms and security case management automation.
- Experience in Red Teaming, Threat Intelligence, or Malware Analysis.
- Understanding of cloud-native security monitoring (AWS, GCP, Azure).
Compensation - For Texas based hires: Estimated annual salary of $115,000-$141,000.
Equity
This role is eligible to participate in Cloudflare's equity plan.
Benefits
Cloudflare offers a complete package of benefits and programs to support you and your family. Our benefits programs can help you pay health care expenses, support caregiving, build capital for the future and make life a little easier and fun! The below is a description of our benefits for employees in the United States, and benefits may vary for employees based outside the U.S.
Health & Welfare Benefits
- Medical/Rx Insurance
- Dental Insurance
- Vision Insurance
- Flexible Spending Accounts
- Commuter Spending Accounts
- Fertility & Family Forming Benefits
- On-demand mental health support and Employee Assistance Program
- Global Travel Medical Insurance
Financial Benefits
- Short and Long Term Disability Insurance
- Life & Accident Insurance
- 401(k) Retirement Savings Plan
- Employee Stock Participation Plan
Time Off
- Flexible paid time off covering vacation and sick leave
- Leave programs, including parental, pregnancy health, medical, and bereavement leave
What Makes Cloudflare Special?
We're not just a highly ambitious, large-scale technology company. We're a highly ambitious, large-scale technology company with a soul. Fundamental to our mission to help build a better Internet is protecting the free and open Internet.
Project Galileo : Since 2014, we've equipped more than 2,400 journalism and civil society organizations in
Incident Response Lead - IT, Cybersecurity Fusion Center

Posted today
Job Viewed
Job Description
Every member of Gilead's team plays a critical role in the discovery and development of life-changing scientific innovations. Our employees are our greatest asset as we work to achieve our bold ambitions, and we're looking for the next wave of passionate and ambitious people ready to make a direct impact.
We believe every employee deserves a great leader. People Leaders are the cornerstone to the employee experience at Gilead and Kite. As a people leader now or in the future, you are the key driver in evolving our culture and creating an environment where every employee feels included, developed and empowered to fulfil their aspirations. Join Gilead and help create possible, together.
**Job Description**
**POSITION SUMMARY**
As a Cyber Security Incident Response Lead, you will be at the forefront of our organization's defense against Cyber threats. This hands-on technical role requires a seasoned Cybersecurity professional with extensive experience in Threat detection & Incident response, a strategic mindset, and the ability to guide and mentor other response teams. Your core role will be to orchestrate the response to complex cybersecurity incidents, ensuring effective mitigation strategies, and contributing to the enhancement of our overall cyber resilience. A key responsibility is to continually assess security monitoring effectiveness and to make recommendations to improve Cyber Security Incident Response capabilities. This position reports to the Director of Cyber Fusion Center (Global Cyber Security Operations) and works closely with key stakeholders in incident response roles company wide.
**_Office Location: Foster City, CA (preferred) or Raleigh, NC_**
**ESSENTIAL JOB FUNCTIONS**
+ Extensive knowledge and experience in handling Cyber Security threats and Incident response activities including Detection, Triage, Investigation, Remediation and Recovery from security issues.
+ Extensive experience as Security Incident commander, leading security investigations while liaising with IT Operations, legal, and business teams through security incidents
+ Extensive experience with designing, implementing, and optimizing a Security Incident Response process
+ Extensive experience with designing and implementing SOC and IR technologies including SIEM, EDR, UEBA, among other capabilities
+ Monitor security events to detect threats and analyze situations in context to detect advanced threats.
+ Alerts analysis
+ Investigate Incidents
+ Analyze Malware
+ Develop Security Operations Center detection tools, rules and intelligence to improve detection & investigation efficiency of the Center.
+ Assess new technologies, tests them in a lab environment and proposes them for SOC improvement.
+ Operate Security Operations Center devices to ensure high availability and security.
+ Maintain and operate SOC network, systems, workstations and other technical components.
+ On-call availability outside business hours.
**REQUIRED SKILLS & JOB QUALIFICATIONS**
+ Minimum 8+ years of IT experience with progressive responsibilities, and with at least 5 years of Cyber Security experience.
+ Security professional with a strong technical background in Cyber Security, Windows / Linux, Network Security, Security Operations Center (SOC), Cloud Security (AWS, Azure), MITRE ATT&CK or similar frameworks, Threat Analysis, IT Operations and Incident response
+ Strong verbal and written communication skills with the ability to adapt information delivery based on the target audience.
+ Ability to create or review procedures for protection of systems and applications.
+ Knowledge of information security principles, concepts, practices, systems software, database software, and immediate access storage technology to carry out activities relating to security certification and accreditation.
+ Ability to provide expert technical advice, guidance, and recommendations to management and other technical specialists on critical information technology security issues.
+ Recommends and coordinates the application of fixes, patches, & recovery procedures in the event of a security breach.
+ Experience with security tools and platforms including SIEM, IPS/IDS, Endpoint and Server protection, Network protection, Firewalls, etc.
+ Extensive experience in Cyber threat and vulnerability analysis and remediation.
+ Forensic examination and data preservation.
+ Significant experience doing internal and external penetration testing (red / blue / purple team experience)
+ Very strong security awareness and knowledge.
+ Strong understanding of key infrastructure systems (Active Directory, Windows/Linux, Databases, Cloud systems)
+ Ability to multitask and manage multiple topics and demands concurrently.
+ Working knowledge of IT processes (i.e., ITIL) including incident, problem, defect, change and release management.
+ Prior working experience in a Pharmaceutical company is a plus.
+ Performs other duties as assigned.
Preferred Skills:
Proficiency in digital forensics, malware analysis, and threat hunting.
Experience with threat intelligence platforms and attack frameworks.
Familiarity with Cloud security threat detection and monitoring best practices.
**EDUCATION & CERTIFICATION**
+ High School Degree and Twelve Years Experience OR Associate's Degree and Ten Years Experience OR Bachelor's Degree and Eight Years Experience OR Master's Degree and Six Years Experience OR PhD
+ Information Security Certification (CISSP, GSEC, GPEN, CEH, etc.) or other related security certification is highly desired.
+ Microsoft, AWS, Linux, Unix, and Cisco certifications would be an asset
People Leader Accountabilities:
-Create Inclusion - knowing the business value of diverse teams, modeling inclusion, and embedding the value of diversity in the
way they manage their teams.
-Develop Talent - understand the skills, experience, aspirations and potential of their employees and coach them on current
performance and future potential. They ensure employees are receiving the feedback and insight needed to grow, develop and
realize their purpose.
-Empower Teams - connect the team to the organization by aligning goals, purpose, and organizational objectives, and holding
them to account. They provide the support needed to remove barriers and connect their team to the broader ecosystem.
The salary range for this position is:
Bay Area: $169,320.00 - $19,120.00.
Raleigh: 146,200.00 - 189,200.00.
Gilead considers a variety of factors when determining base compensation, including experience, qualifications, and geographic location. These considerations mean actual compensation will vary. This position may also be eligible for a discretionary annual bonus, discretionary stock-based long-term incentives (eligibility may vary based on role), paid time off, and a benefits package. Benefits include company-sponsored medical, dental, vision, and life insurance plans*.
For additional benefits information, visit:
Eligible employees may participate in benefit plans, subject to the terms and conditions of the applicable plans.
**For jobs in the United States:**
Gilead Sciences Inc. is committed to providing equal employment opportunities to all employees and applicants for employment, and is dedicated to fostering an inclusive work environment comprised of diverse perspectives, backgrounds, and experiences. Employment decisions regarding recruitment and selection will be made without discrimination based on race, color, religion, national origin, sex, age, sexual orientation, physical or mental disability, genetic information or characteristic, gender identity and expression, veteran status, or other non-job related characteristics or other prohibited grounds specified in applicable federal, state and local laws. In order to ensure reasonable accommodation for individuals protected by Section 503 of the Rehabilitation Act of 1973, the Vietnam Era Veterans' Readjustment Act of 1974, and Title I of the Americans with Disabilities Act of 1990, applicants who require accommodation in the job application process may contact for assistance.
For more information about equal employment opportunity protections, please view the 'Know Your Rights' ( poster.
NOTICE: EMPLOYEE POLYGRAPH PROTECTION ACT ( RIGHTS UNDER THE FAMILY AND MEDICAL LEAVE ACT
PAY TRANSPARENCY NONDISCRIMINATION PROVISION ( environment respects individual differences and recognizes each employee as an integral member of our company. Our workforce reflects these values and celebrates the individuals who make up our growing team.
Gilead provides a work environment free of harassment and prohibited conduct. We promote and support individual differences and diversity of thoughts and opinion.
**For Current Gilead Employees and Contractors:**
Please apply via the Internal Career Opportunities portal in Workday.
Gilead Sciences, Inc. is a biopharmaceutical company that has pursued and achieved breakthroughs in medicine for more than three decades, with the goal of creating a healthier world for all people. The company is committed to advancing innovative medicines to prevent and treat life-threatening diseases, including HIV, viral hepatitis and cancer. Gilead operates in more than 35 countries worldwide, with headquarters in Foster City, California.
Senior Product Manager - Incident Response (San Francisco)
Posted 3 days ago
Job Viewed
Job Description
Do you want to help make the world safe from cyber attack?
At Corelight, we believe that the best approach to cybersecurity risk starts with the network. Attackers can evade endpoint detection, firewalls and many other technologies - but they can’t avoid leaving digital footprints on the networks they traverse. Built on open-source innovations from Zeek, Suricata and YARA and refined through years of real-world use, Corelight transforms network footprints from physical, virtual and cloud networks into actionable insights. Our customers use these insights to speed incident response and proactively hunt for threats.
We are looking for a cybersecurity and enterprise platform veteran to join our Product Management Team. Investigator is our SaaS platform for the enterprise SOC. This person will play a critical role in ensuring Investigator meets the needs of all enterprises. This will include advancing capabilities in policy management, asset databases, and policy configuration and optimization. This person will work closely with customer SOC Managers, CISOs, and oversight roles to ensure Investigator, as a SaaS platform, meets enterprise compliance and operational needs.
As part of the Investigator Product Management team, you will work with engineers, UX designers, and fellow Product Managers to define and execute our roadmap. Your focus will be on general platform features, policy assignment, policy tuning, alert prioritization, and building a centralized asset database that drives everything from policy assignment to triage context. You will drive execution to deliver scalable, high-impact solutions that simplify enterprise security operations.
Responsibilities
- Own the policy and asset database roadmap within the Investigator platform, ensuring device groups and policy assignment work seamlessly together.
- Develop tuning mechanisms that maximize granular tuning of policy quickly and easily.
- Develop custom prioritization engines with great defaults but a focus on putting the power in the customer’s hands.
- Build out powerful CMDB/CAASM-like asset management capabilities to improve everything from policy assignment to triage context.
- Work with SOC teams and CISOs to validate policy workflows and ensure the platform meets oversight and compliance needs.
- Collaborate with sales and customers to prioritize features that have the biggest impact on security operations.
- Write detailed product requirements, ensuring engineering has a clear understanding of expectations.
- Work closely with team members to ensure policy workflows support effective detection and investigation processes.
- Drive executive reporting to support SOC leadership in tracking detection effectiveness.
Required Qualifications
- 5+ years of experience in cybersecurity, with a strong focus on enterprise security workflows, policy management, or asset intelligence.
- 3+ years in product management or a similar role, driving roadmap and feature execution.
- Experience with security operations (SOC), including detection tuning, policy frameworks, and compliance needs.
- Strong understanding of network security monitoring, intrusion detection, and enterprise security architecture.
- Familiarity with CMDB, CAASM, or asset intelligence tools and their role in security operations.
- Strong knowledge of SOC workflows and security event triage processes.
- Experience working with enterprise IT/security leaders (CISO, SOC Managers, Compliance Teams) to align security policies with operational needs.
- Ability to work cross-functionally with engineering, UX, and customers to deliver scalable solutions.
Preferred Qualifications
- Experience as a Product Owner/Product Manager in an Agile/Scrum environment.
- Excellent communication skills with experience collaborating across UX, engineering, and security teams.
- Familiarity with data analytics, AI-assisted security decision-making, and automation.
- Experience with building and shipping SaaS-based security services.
- Education: Degrees in Computer Science, Cybersecurity, or related technical disciplines (or equivalent experience).
Fueled by investments from top-tier venture capital organizations such as Crowdstrike, Accel, and Insight, Corelight is the fastest growing network detection and response platform in the industry. Our customers trust us to protect mission-critical assets in leading enterprises, government, and research institutions worldwide. We are leading the way with AI-assisted workflows, machine learning models, cloud security, and SaaS-based solutions to arm defenders with the tools and knowledge they need to disrupt cyber attacks. Our team of passionate innovators are dedicated to solving some of the toughest challenges in cybersecurity, while fostering a collaborative, inclusive, and growth-oriented culture. Corelight is committed to a geographically distributed yet connected employee base with employees working from home and office locations around the world. At Corelight, we are proud of our diversity of background and thought, and we’re united by our strong shared culture and values.
We are looking forward to meeting you. Check us out at
Be The First To Know
About the latest Incident response Jobs in San francisco !
Director of IT Security Fusion Center (SOC and Incident Response)
Posted 8 days ago
Job Viewed
Job Description
Director of IT Security Fusion Center (SOC and Incident Response) Join to apply for the Director of IT Security Fusion Center (SOC and Incident Response) role at Gilead Sciences Director of IT Security Fusion Center (SOC and Incident Response) Join to apply for the Director of IT Security Fusion Center (SOC and Incident Response) role at Gilead Sciences Get AI-powered advice on this job and more exclusive features. At Gilead, we’re creating a healthier world for all people. For more than 35 years, we’ve tackled diseases such as HIV, viral hepatitis, COVID-19 and cancer – working relentlessly to develop therapies that help improve lives and to ensure access to these therapies across the globe. We continue to fight against the world’s biggest health challenges, and our mission requires collaboration, determination and a relentless drive to make a difference. Every member of Gilead’s team plays a critical role in the discovery and development of life-changing scientific innovations. Our employees are our greatest asset as we work to achieve our bold ambitions, and we’re looking for the next wave of passionate and ambitious people ready to make a direct impact. We believe every employee deserves a great leader. People Leaders are the cornerstone to the employee experience at Gilead and Kite. As a people leader now or in the future, you are the key driver in evolving our culture and creating an environment where every employee feels included, developed and empowered to fulfil their aspirations. Join Gilead and help create possible, together. Job Description Gilead Sciences, Inc. is a biopharmaceutical company that has pursued and achieved breakthroughs in medicine for more than three decades, with the goal of creating a healthier world for all people. The company is committed to pursuing scientific invention to prevent and treat life-threatening diseases, including HIV, viral hepatitis and cancer. Gilead has operations in more than 35 countries worldwide, with headquarters in Foster City, California. You will be part of a team that is helping millions of people live healthier, more fulfilling lives. We are a close community where every individual matters and everyone has a chance to enhance their skills through ongoing development. Inclusion is one of our core values, which means we are creating and fostering a work environment where our differences are valued, and everyone feels respected and empowered to bring their authentic selves to work. By joining Gilead, you will further our mission to discover, develop and deliver innovative therapeutics for people with life-threatening diseases. The Gilead Business Services center in Raleigh North Carolina is home to some of the company’s critical shared service teams in North America, including Information Technology, Global Financial Solutions, HR Operations, R&D Data Science and Procurement Services Desk. These functions provide the necessary support to ensure Gilead’s business runs effectively and efficiently. The center is a catalyst for standardization of processes, digital transformation and technology optimization. Position Summary The Director of IT Security Fusion Center is responsible for managing and leading our Security Fusion Center comprised of the SOC and Incident Response teams. This critical team will be responsible for monitoring and detection of Security events leveraging industry leading security tools and security vendors and partners. This critical role will lead the Security Fusion center to triage, provide incident response management, and conduct security investigations and forensics for potential security events. The leader will articulate technical security requirements, monitor the effectiveness of the existing IT security controls framework, and raise the level of security awareness and policy compliance within IT and business groups. The individual in this role will be part of the IT Security, Risk, and Compliance team within Information Technology and work with Security, Infrastructure and Business Application services team to manage and remediate any security threats and incidents. Essential Job Functions Extensive security experience leading a SOC and IR team to detect, assess, investigate, remediate and recover from security issues. Extensive experience as Security Incident commander, leading a SOC team while liaising with IT, legal, and business teams through security incidents Extensive experience with designing, implementing, and optimizing a Security Incident Response process Extensive experience with designing and implementing SOC and IR technologies including SIEM, EDR, UEBA, among other capabilities Experience managing, leading, and mentoring a technical and process minded team, working with Managed Services, and managing a large SOC team. Monitor security events to detect threats and analyze situations in context to detect advanced threats. Alerts analysis Investigate Incidents Analyze Malware Recommend corrective actions to the IT leadership team. Develop Security Operations Center detection tools, rules and intelligence to improve detection & investigation efficiency of the Center. Learn from investigated cases and update toolsets to improve automated detection methods Assess new technologies, tests them in a lab environment and proposes them for SOC improvement. Operate Security Operations Center devices to ensure high availability and security. Maintain and operate SOC network, systems, workstations and other technical components. Interact in a very professional way with customers to solve identified threats and issues. Act as a privileged point of contact for the customers to solve security requests, incidents and threats. Define SOC service architecture. Deploy/support deployment of the monitoring solution to customer for integration in the Security Operations Center service. On-call availability outside business hours. Required Skills & Job Qualifications Minimum 12+ years of IT experience with progressive responsibilities, and with at least 8 years of Cyber Security protection experience. Security professional with a proven people management and leadership experience within the security industry. Strong verbal and written communication skills with the ability to adapt information delivery based on the target audience. Ability to interpret, understand, and communicate real business risks in relation to technology risks. Ability to create or review procedures for protection of systems and applications. Knowledge of information security principles, concepts, practices, systems software, database software, and immediate access storage technology to carry out activities relating to security certification and accreditation. Ability to provide expert technical advice, guidance, and recommendations to management and other technical specialists on critical information technology security issues. Recommends and coordinates the application of fixes, patches, & recovery procedures in the event of a security breach. Experience with security tools and platforms including SIEM, IPS/IDS, SecOps, Endpoint and Server protection, Network protection, Firewalls, etc. Extensive experience in Cyber threat and vulnerability analysis and remediation. Forensic examination and data preservation. Significant experience doing internal and external penetration testing i.e. white hat hacking. Ability to work in a fast paced, highly visible, changing environment. Very strong security awareness and knowledge. Strong understanding of key infrastructure systems (AD, Linux, Databases, Virtual Environment). Proven ability at building working relationships with partners, peers, and senior Management. Experienced with leading a cross functional team to performs and review security incident investigations. Ability to multitask and manage multiple topics and demands concurrently. Working knowledge of IT processes (i.e., ITIL) including incident, problem, defect, change and release management Prior working experience in a Pharmaceutical company is a plus. Highly organized, results-oriented and attentive to details. Self-motivated, proactive, independent and responsive – requires little supervisory attention. Excellent presentation, facilitation and diplomacy skills. High level of personal integrity consistent with company’s core values. Performs other duties as assigned. EDUCATION & CERTIFICATION Bachelor of Science degree in management information systems, computer science, engineering or other IT-related major is required, or 10+ years of relevant experience. Information Security Certification (CISSP, GSEC, GPEN, CEH, etc.) or other related security certification is highly desired. Microsoft, Linux, Unix, and Cisco certifications would be an asset Gilead Core Values Integrity (Doing What’s Right) Inclusion (Encouraging Diversity) Teamwork (Working Together) Excellence (Being Your Best) Accountability (Taking Personal Responsibility) The salary range for this position is: $210,375.00 - $72,250.00. Gilead considers a variety of factors when determining base compensation, including experience, qualifications, and geographic location. These considerations mean actual compensation will vary. This position may also be eligible for a discretionary annual bonus, discretionary stock-based long-term incentives (eligibility may vary based on role), paid time off, and a benefits package. Benefits include company-sponsored medical, dental, vision, and life insurance plans*. For Additional Benefits Information, Visit Eligible employees may participate in benefit plans, subject to the terms and conditions of the applicable plans. For Jobs In The United States Gilead Sciences Inc. is committed to providing equal employment opportunities to all employees and applicants for employment, and is dedicated to fostering an inclusive work environment comprised of diverse perspectives, backgrounds, and experiences. Employment decisions regarding recruitment and selection will be made without discrimination based on race, color, religion, national origin, sex, age, sexual orientation, physical or mental disability, genetic information or characteristic, gender identity and expression, veteran status, or other non-job related characteristics or other prohibited grounds specified in applicable federal, state and local laws. In order to ensure reasonable accommodation for individuals protected by Section 503 of the Rehabilitation Act of 1973, the Vietnam Era Veterans' Readjustment Act of 1974, and Title I of the Americans with Disabilities Act of 1990, applicants who require accommodation in the job application process may contact for assistance. For more information about equal employment opportunity protections, please view the 'Know Your Rights' poster. NOTICE: EMPLOYEE POLYGRAPH PROTECTION ACT YOUR RIGHTS UNDER THE FAMILY AND MEDICAL LEAVE ACT PAY TRANSPARENCY NONDISCRIMINATION PROVISION Our environment respects individual differences and recognizes each employee as an integral member of our company. Our workforce reflects these values and celebrates the individuals who make up our growing team. Gilead provides a work environment free of harassment and prohibited conduct. We promote and support individual differences and diversity of thoughts and opinion. For Current Gilead Employees And Contractors Please apply via the Internal Career Opportunities portal in Workday. Seniority level Seniority level Not Applicable Employment type Employment type Full-time Job function Job function Information Technology Industries Biotechnology Research and Pharmaceutical Manufacturing Referrals increase your chances of interviewing at Gilead Sciences by 2x Get notified about new Director Information Technology Security jobs in Foster City, CA . Director, Cybersecurity - Identity and Zero Trust Director, Identity and Access Management Services San Francisco, CA 208,400.00- 303,800.00 3 months ago Sunnyvale, CA 211,100.00- 372,600.00 1 week ago Fremont, CA 175,824.00- 259,596.00 5 months ago San Francisco, CA 176,878.00- 274,430.00 4 weeks ago Santa Clara, CA 189,000.00- 260,000.00 5 days ago San Francisco, CA 250,000.00- 300,000.00 2 weeks ago Santa Clara, CA 189,000.00- 260,000.00 5 days ago Associate Director, Global Business Svcs Tech Enablement Strategy Associate Director, Global Business Svcs Tech Enablement Strategy Campaign Director, Social Media (Cybersecurity) San Francisco, CA 125,000.00- 150,000.00 1 day ago Public Relations Account Director (B2B Technology, Cybersecurity, Financial Services) San Francisco, CA 125,000.00- 150,000.00 1 month ago Senior Manager, IT Operations & Security Redwood City, CA 160,000.00- 500,000.00 2 weeks ago Palo Alto, CA 218,800.00- 312,500.00 2 weeks ago Menlo Park, CA 208,080.00- 411,870.00 2 weeks ago San Francisco, CA 187,500.00- 359,400.00 6 days ago San Francisco, CA 130,000.00- 140,000.00 18 hours ago IT Managing Director, Risk Advisory Services San Francisco, CA 220,000.00- 250,000.00 3 weeks ago IT Director, Enterprise Architecture and Development Alameda, CA 200,000.00- 250,000.00 7 hours ago Oakland, CA 131,000.00- 200,790.00 2 days ago Milpitas, CA 150,000.00- 180,000.00 2 weeks ago South San Francisco, CA 201,000.00- 223,000.00 22 hours ago Palo Alto, CA 150,000.00- 175,000.00 1 month ago We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI. #J-18808-Ljbffr
Director of IT Security Fusion Center (SOC and Incident Response)

Posted today
Job Viewed
Job Description
Every member of Gilead's team plays a critical role in the discovery and development of life-changing scientific innovations. Our employees are our greatest asset as we work to achieve our bold ambitions, and we're looking for the next wave of passionate and ambitious people ready to make a direct impact.
We believe every employee deserves a great leader. People Leaders are the cornerstone to the employee experience at Gilead and Kite. As a people leader now or in the future, you are the key driver in evolving our culture and creating an environment where every employee feels included, developed and empowered to fulfil their aspirations. Join Gilead and help create possible, together.
**Job Description**
Gilead Sciences, Inc. is a biopharmaceutical company that has pursued and achieved breakthroughs in medicine for more than three decades, with the goal of creating a healthier world for all people. The company is committed to pursuing scientific invention to prevent and treat life-threatening diseases, including HIV, viral hepatitis and cancer. Gilead has operations in more than 35 countries worldwide, with headquarters in Foster City, California.
You will be part of a team that is helping millions of people live healthier, more fulfilling lives. We are a close community where every individual matters and everyone has a chance to enhance their skills through ongoing development. Inclusion is one of our core values, which means we are creating and fostering a work environment where our differences are valued, and everyone feels respected and empowered to bring their authentic selves to work. By joining Gilead, you will further our mission to discover, develop and deliver innovative therapeutics for people with life-threatening diseases.
The Gilead Business Services center in Raleigh North Carolina is home to some of the company's critical shared service teams in North America, including Information Technology, Global Financial Solutions, HR Operations, R&D Data Science and Procurement Services Desk. These functions provide the necessary support to ensure Gilead's business runs effectively and efficiently. The center is a catalyst for standardization of processes, digital transformation and technology optimization.
**POSITION SUMMARY**
The Director of IT Security Fusion Center is responsible for managing and leading our Security Fusion Center comprised of the SOC and Incident Response teams. This critical team will be responsible for monitoring and detection of Security events leveraging industry leading security tools and security vendors and partners. This critical role will lead the Security Fusion center to triage, provide incident response management, and conduct security investigations and forensics for potential security events. The leader will articulate technical security requirements, monitor the effectiveness of the existing IT security controls framework, and raise the level of security awareness and policy compliance within IT and business groups. The individual in this role will be part of the IT Security, Risk, and Compliance team within Information Technology and work with Security, Infrastructure and Business Application services team to manage and remediate any security threats and incidents.
**ESSENTIAL JOB FUNCTIONS:**
+ Extensive security experience leading a SOC and IR team to detect, assess, investigate, remediate and recover from security issues.
+ Extensive experience as Security Incident commander, leading a SOC team while liaising with IT, legal, and business teams through security incidents Extensive experience with designing, implementing, and optimizing a Security Incident Response process
+ Extensive experience with designing and implementing SOC and IR technologies including SIEM, EDR, UEBA, among other capabilities
+ Experience managing, leading, and mentoring a technical and process minded team, working with Managed Services, and managing a large SOC team. Monitor security events to detect threats and analyze situations in context to detect advanced threats.
- Alerts analysis
- Investigate Incidents
- Analyze Malware
+ Recommend corrective actions to the IT leadership team.
+ Develop Security Operations Center detection tools, rules and intelligence to improve detection & investigation efficiency of the Center.
+ Learn from investigated cases and update toolsets to improve automated detection methods
+ Assess new technologies, tests them in a lab environment and proposes them for SOC improvement.
+ Operate Security Operations Center devices to ensure high availability and security.
+ Maintain and operate SOC network, systems, workstations and other technical components.
+ Interact in a very professional way with customers to solve identified threats and issues.
+ Act as a privileged point of contact for the customers to solve security requests, incidents and threats.
+ Define SOC service architecture.
+ Deploy/support deployment of the monitoring solution to customer for integration in the Security Operations Center service.
+ On-call availability outside business hours.
REQUIRED SKILLS & JOB QUALIFICATIONS
+ Minimum 12+ years of IT experience with progressive responsibilities, and with at least 8 years of Cyber Security protection experience.
+ Security professional with a proven people management and leadership experience within the security industry.
+ Strong verbal and written communication skills with the ability to adapt information delivery based on the target audience.
+ Ability to interpret, understand, and communicate real business risks in relation to technology risks.
+ Ability to create or review procedures for protection of systems and applications.
+ Knowledge of information security principles, concepts, practices, systems software, database software, and immediate access storage technology to carry out activities relating to security certification and accreditation.
+ Ability to provide expert technical advice, guidance, and recommendations to management and other technical specialists on critical information technology security issues. Recommends and coordinates the application of fixes, patches, & recovery procedures in the event of a security breach.
+ Experience with security tools and platforms including SIEM, IPS/IDS, SecOps, Endpoint and Server protection, Network protection, Firewalls, etc. Extensive experience in Cyber threat and vulnerability analysis and remediation. Forensic examination and data preservation.
+ Significant experience doing internal and external penetration testing i.e. white hat hacking.
+ Ability to work in a fast paced, highly visible, changing environment. Very strong security awareness and knowledge.
+ Strong understanding of key infrastructure systems (AD, Linux, Databases, Virtual Environment).
+ Proven ability at building working relationships with partners, peers, and senior Management.
+ Experienced with leading a cross functional team to performs and review security incident investigations.
+ Ability to multitask and manage multiple topics and demands concurrently. Working knowledge of IT processes (i.e., ITIL) including incident, problem, defect, change and release management
+ Prior working experience in a Pharmaceutical company is a plus.
+ Highly organized, results-oriented and attentive to details. Self-motivated, proactive, independent and responsive - requires little supervisory attention. Excellent presentation, facilitation and diplomacy skills.
+ High level of personal integrity consistent with company's core values. Performs other duties as assigned.
**EDUCATION & CERTIFICATION**
+ Bachelor of Science degree in management information systems, computer science, engineering or other IT-related major is required, or 10+ years of relevant experience.
+ Information Security Certification (CISSP, GSEC, GPEN, CEH, etc.) or other related security certification is highly desired. Microsoft, Linux, Unix, and Cisco certifications would be an asset
**Gilead Core Values:**
Integrity (Doing What's Right)
Inclusion (Encouraging Diversity)
Teamwork (Working Together)
Excellence (Being Your Best)
Accountability (Taking Personal Responsibility)
The salary range for this position is: $210,375.00 - $272,250.00. Gilead considers a variety of factors when determining base compensation, including experience, qualifications, and geographic location. These considerations mean actual compensation will vary. This position may also be eligible for a discretionary annual bonus, discretionary stock-based long-term incentives (eligibility may vary based on role), paid time off, and a benefits package. Benefits include company-sponsored medical, dental, vision, and life insurance plans*.
For additional benefits information, visit:
Eligible employees may participate in benefit plans, subject to the terms and conditions of the applicable plans.
**For jobs in the United States:**
Gilead Sciences Inc. is committed to providing equal employment opportunities to all employees and applicants for employment, and is dedicated to fostering an inclusive work environment comprised of diverse perspectives, backgrounds, and experiences. Employment decisions regarding recruitment and selection will be made without discrimination based on race, color, religion, national origin, sex, age, sexual orientation, physical or mental disability, genetic information or characteristic, gender identity and expression, veteran status, or other non-job related characteristics or other prohibited grounds specified in applicable federal, state and local laws. In order to ensure reasonable accommodation for individuals protected by Section 503 of the Rehabilitation Act of 1973, the Vietnam Era Veterans' Readjustment Act of 1974, and Title I of the Americans with Disabilities Act of 1990, applicants who require accommodation in the job application process may contact for assistance.
For more information about equal employment opportunity protections, please view the 'Know Your Rights' ( poster.
NOTICE: EMPLOYEE POLYGRAPH PROTECTION ACT ( RIGHTS UNDER THE FAMILY AND MEDICAL LEAVE ACT
PAY TRANSPARENCY NONDISCRIMINATION PROVISION ( environment respects individual differences and recognizes each employee as an integral member of our company. Our workforce reflects these values and celebrates the individuals who make up our growing team.
Gilead provides a work environment free of harassment and prohibited conduct. We promote and support individual differences and diversity of thoughts and opinion.
**For Current Gilead Employees and Contractors:**
Please apply via the Internal Career Opportunities portal in Workday.
Gilead Sciences, Inc. is a biopharmaceutical company that has pursued and achieved breakthroughs in medicine for more than three decades, with the goal of creating a healthier world for all people. The company is committed to advancing innovative medicines to prevent and treat life-threatening diseases, including HIV, viral hepatitis and cancer. Gilead operates in more than 35 countries worldwide, with headquarters in Foster City, California.
Senior Security Solutions Architect (Threat Detection & Incident Response), Security Specialist SAs

Posted today
Job Viewed
Job Description
AWS Global Sales drives adoption of the AWS cloud worldwide, enabling customers of all sizes to innovate and expand in the cloud. Our team empowers every customer to grow by providing tailored service, unmatched technology, and unwavering support. We dive deep to understand each customer's unique challenges, then craft innovative solutions that accelerate their success. This customer-first approach is how we built the world's most adopted cloud. Join us and help us grow.
Amazon Web Services (AWS) is looking for a passionate and experienced professional to assist customers in migrating workloads to the cloud. The ideal candidate will address customer threat detection and incident response requirements, and help them secure their generative AI applications.
Do you have a unique combination of in-depth technical knowledge, business acumen, and strong interpersonal skills? Are you skilled at helping customers to build cloud-native threat detection and incident response capabilities using highly scalable computing architectures? Do have experience designing and implementing security for generative AI technologies? Do you like helping organizational leaders think through how to secure workloads in the Cloud?
The ideal candidate should be a technical security professional who has the ability to consult and build a wide range of threat detection and incident response capabilities, advise on securing generative AI applications, is willing to dive in to the details, can build scalable solutions, and is able to communicate at all levels within an organization. You should also have a demonstrated ability to think strategically about business, security, and technical challenges.
Key job responsibilities
- Independently contribute to teams that include Amazonians, partners, and customers to design and build both threat detection and incident response capabilities
- Provide security expertise and support for customers implementing generative AI technologies, ensuring secure and compliant deployments.
- Design and build solutions to automate security, risk, and compliance on AWS.
- Develop high-quality technical artifacts, such as automation tools, reference architectures, and white papers to help our customers, partners, solution architects, and consultants build secure solutions.
- Work with AWS customers to convey cloud computing security, risk, and compliance best practices.
- Work with other teams within AWS to influence and drive adoption of security, risk, and compliance products.
- Provide mentorship across AWS sales and solutions architecture teams regarding security to build skills in the field.
- Represent AWS at trade events by delivering security presentations and workshops.
- Some travel required (up to 20%)
About the team
Diverse Experiences
AWS values diverse experiences. Even if you do not meet all of the preferred qualifications and skills listed in the job description, we encourage candidates to apply. If your career is just starting, hasn't followed a traditional path, or includes alternative experiences, don't let it stop you from applying.
Why AWS?
Amazon Web Services (AWS) is the world's most comprehensive and broadly adopted cloud platform. We pioneered cloud computing and never stopped innovating - that's why customers from the most successful startups to Global 500 companies trust our robust suite of products and services to power their businesses.
Inclusive Team Culture
AWS values curiosity and connection. Our employee-led and company-sponsored affinity groups promote inclusion and empower our people to take pride in what makes us unique. Our inclusion events foster stronger, more collaborative teams. Our continual innovation is fueled by the bold ideas, fresh perspectives, and passionate voices our teams bring to everything we do.
Mentorship & Career Growth
We're continuously raising our performance bar as we strive to become Earth's Best Employer. That's why you'll find endless knowledge-sharing, mentorship and other career-advancing resources here to help you develop into a better-rounded professional.
Work/Life Balance
We value work-life harmony. Achieving success at work should never come at the expense of sacrifices at home, which is why we strive for flexibility as part of our working culture. When we feel supported in the workplace and at home, there's nothing we can't achieve.
Basic Qualifications
- 8+ years of specific technology domain areas (e.g. software development, cloud computing, systems engineering, infrastructure, security, networking, data & analytics) experience
- 4+ years of IT development or implementation/consulting in the software or Internet industries experience
- BS degree in computer science, MIS, computer engineering, or equivalent experience.
Preferred Qualifications
- Experience communicating across technical and non-technical audiences, including executive level stakeholders or clients
- Experience migrating or transforming legacy customer solutions to the cloud
- Experience in a customer-facing, sales-aligned role such as consultant, solutions engineer or solutions architect.
- Experience working across various Security disciplines such as Detection Engineering, Threat Intelligence, Threat Hunting and Incident Response in enterprise environments.
- Hands-on technical expertise in building scripts, tools, or methodologies that enhance customers' threat detection and incident response capabilities
- Experience with Large Language Model (LLM) security including attack techniques and mitigation methods
- An advanced degree in computer science, MIS, engineering or related discipline, and relevant industry certifications (CISSP, CISA/M, CCSP) or equivalent experience
Amazon is an equal opportunity employer and does not discriminate on the basis of protected veteran status, disability, or other legally protected status.
Los Angeles County applicants: Job duties for this position include: work safely and cooperatively with other employees, supervisors, and staff; adhere to standards of excellence despite stressful conditions; communicate effectively and respectfully with employees, supervisors, and staff to ensure exceptional customer service; and follow all federal, state, and local laws and Company policies. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness and professionalism, and safeguard business operations and the Company's reputation. Pursuant to the Los Angeles County Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.
Pursuant to the San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.
Our inclusive culture empowers Amazonians to deliver the best results for our customers. If you have a disability and need a workplace accommodation or adjustment during the application and hiring process, including support for the interview or onboarding process, please visit for more information. If the country/region you're applying in isn't listed, please contact your Recruiting Partner.
Our compensation reflects the cost of labor across several US geographic markets. The base pay for this position ranges from $138,200/year in our lowest geographic market up to $239,000/year in our highest geographic market. Pay is based on a number of factors including market location and may vary depending on job-related knowledge, skills, and experience. Amazon is a total compensation company. Dependent on the position offered, equity, sign-on payments, and other forms of compensation may be provided as part of a total compensation package, in addition to a full range of medical, financial, and/or other benefits. For more information, please visit . This position will remain posted until filled. Applicants should apply via our internal or external career site.