Senior Security Engineer, DFIR

Role overview Investigate security incidents and platform abuse across cloud based products and internal systems, then turn findings into durable defenses. The role combines digital forensics, incident response, security engineering, and collaboration with teams responsible for fixing underlying issues. It also includes building AI assisted workflows that make repeatable investigations more effective while keeping evidence, access controls, and human review central.

Responsibilities - Lead investigations from evidence collection and analysis through impact assessment, root cause, response, and remediation follow up. - Identify abuse patterns and threat indicators, develop actionable intelligence, and improve detection to reduce repeat incidents. - Build and refine automated or agent based workflows for incident response, forensics, and security audits; validate their outputs against evidence. - Design and deploy software changes, response tools, and automated controls that address security weaknesses in products and internal systems. - Partner with engineering, product, data, and operations teams to explain findings, shape practical defenses, and mentor colleagues.

Requirements - Several years in technology or software development, including building and maintaining tools or automation for operational problems. - Hands on experience investigating security threats or platform abuse using logs and other evidence, and communicating findings and impact. - Experience with cloud or SaaS environments and using application, identity, or audit data to investigate suspicious activity. - Practical use of AI assisted development or agentic workflows, with the judgment to validate results and involve human review when needed. - Ability to turn security findings into software design changes, response improvements, or automated controls. - Clear written communication and the ability to build working relationships and mentor others.

Nice to have - Experience applying AI agents in security operations or incident response, and familiarity with agent security risks such as confused deputy scenarios. - Experience with security testing and monitoring tools, including SAST, DAST, RASP, dependency analysis, or SIEM. - AWS experience, including IAM and least privilege design; the source also cites 3+ years of software development and 1+ year of security experience.