Opportunity at
DatabricksStaff Security Engineer, Incident Response
Databricks, a data and AI company, is hiring a Staff Security Engineer for its Incident Response group. The group handles threats, investigations and incidents to protect…
Career Tools
About This Role
Databricks, a data and AI company, is hiring a Staff Security Engineer for its Incident Response group. The group handles threats, investigations and incidents to protect customers, employees and enterprise data. It runs its security operations on the company's own platform, producing near-real-time log analysis, alerting and forensic evidence with the same product it sells. The role is an individual contributor position reporting to the regional Incident Response manager. The…
Job Description
Databricks, a data and AI company, is hiring a Staff Security Engineer for its Incident Response group. The group handles threats, investigations and incidents to protect customers, employees and enterprise data. It runs its security operations on the company's own platform, producing near-real-time log analysis, alerting and forensic evidence with the same product it sells.
The role is an individual contributor position reporting to the regional Incident Response manager. The engineer will join a globally distributed round-the-clock rota, handle high-priority alerts and contain threats, and carry out forensic work across many data sources to determine the sequence and reach of each event.
Beyond responding, the engineer is expected to offer technical guidance and influence direction. That means creating autonomous capabilities powered by AI and agent platforms, communicating technical choices through written design proposals and talks, and mentoring junior responders via coaching, design critiques and code critiques.
Applicants need either a bachelor's degree with seven or more years in incident response or a master's degree with five or more years. Cloud security depth is required in one of AWS, GCP or Azure, with working fluency in the remaining two. Competence with AI, language models and agent-based tooling is essential, and experience building agent systems for security purposes is a plus.
The posting emphasizes broad security knowledge and deep skill in several response disciplines such as digital forensics, reverse engineering, network defense, storage and access protection, sandboxing and compute protection. Background in securing enterprise software and SaaS products, working knowledge of SIEM and SOAR platforms, and scripting and tooling for response work are also listed. Databricks notes that it may turn down candidates whose role would involve export-controlled technology or code that needs a US government license.
Responsibilities
- Join a rotating on-call schedule that covers the clock
- Triage security events and alerts and contain them quickly
- Investigate across many data sources to reconstruct timelines and scope
- Offer technical leadership and steer team direction
- Build AI and agentic solutions that automate work and extend the team's reach
- Record technical reasoning in design write-ups and presentations
- Coach junior responders through mentorship, design critiques and code critiques
Requirements
- Bachelor's plus 7+ years of IR experience, or master's plus 5+ years
- Cloud security depth in one of AWS, GCP or Azure, plus working fluency with the remaining platforms
- Competence with AI, LLM and agentic capabilities
- Wide-ranging security knowledge
- Deep skills in a few core response areas, such as DFIR, reverse engineering, network defense, storage and access security, sandboxing and compute security
- Background in securing enterprise software and SaaS products
- Working familiarity with SIEM and SOAR tools
Qualifications
- Building and running agent-based systems for security work
- Developing incident response tooling
- Scripting and experience with AI coding assistants
Core Skills
Benefits
- Comprehensive benefits and perks that vary by region
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
How many years of experience are required?
A bachelor's degree and at least seven years of incident response experience, or a master's degree and at least five years.
Is on-call work required?
Yes. The role includes taking part in a rotating on-call schedule that runs around the clock.
Is a location listed?
The posting does not state a specific office location.
Is a salary listed?
The posting does not state a salary.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
