Senior Security Engineer, Incident Response

Airbnb

6h•$196,000 - $227,000•Remote

About The Position

The Threat Detection and Response (TDR) team at Airbnb is responsible for automating security detection, responding to security incidents, and collaborating with partner teams to develop capabilities that support the incident lifecycle. This team acts as the first line of defense, detecting, investigating, and responding to internal and external security threats and malicious activities. This role is crucial for defining and implementing the vision for threat detection and incident response capabilities and processes, while also mentoring other team members. As a senior engineer, you will directly contribute to building, optimizing, and expanding security capabilities, delivering world-class threat detection and incident response.

Requirements

5+ years of hands-on, in-depth knowledge and technical experience in security operations, including investigations, incident response, incident management, digital forensics, threat intelligence, threat hunting, and/or detection engineering.
Proficiency in Python or other scripting languages.
Experience with SQL and Pandas.
Self-motivated and creative problem-solver able to work independently with minimal guidance.
Ability to lead people in complex, ambiguous situations through influence rather than authority.
Ability to work calmly and collaboratively in critical high-stress situations with expediency.
Outstanding organizational, prioritization, and multitasking skills.
Knowledge and familiarity of the Cyber Kill Chain Framework and MITRE ATT&CK Framework and their application to the threat landscape.
Experience automating security detection and response.

Nice To Haves

Familiarity with Elasticsearch is preferred.
Experience in AWS services (EC2, S3, Lambda, RDS) is preferred.

Responsibilities

Perform investigations of security incidents using knowledge of digital forensics and data analytics.
Utilize coding, data analytics, and investigation skills to hunt, detect, and respond to threats.
Build automation and detection models to identify anomalous activity and support large-scale threat response.
Hunt for threats in corporate and production environments to proactively identify anomalous activity.
Collaborate with engineering teams to build advanced detection solutions and partner with teams to conduct complex investigations.
Identify infrastructure gaps and work with business partners to improve visibility through logging and detection.
Collaborate effectively with cross-functional teams, including Legal, Privacy, and Engineering, for efficient, large-scale response.