Sr. Cybersecurity Engineer

Rivian•Palo Alto, CA

13h•Hybrid

About The Position

Rivian is seeking an Incident Commander to lead cybersecurity response through a code-first approach. The role focuses on minimizing impact and downtime by deploying automation and ensuring observability across the environment. The Incident Commander will lead critical cybersecurity incidents while building integrations and tools to scale detection, response, and recovery capabilities. This is a hybrid role in Atlanta, Georgia, reporting to the Sr. Manager Cybersecurity. The position combines incident command and crisis management with proactive security engineering. It includes developing automation and SOAR workflows, improving threat detection and monitoring, leading blameless after-action reviews, and integrating security tools with DevOps and infrastructure systems. The role also participates in a structured on-call rotation for coverage outside standard business hours.

Requirements

At least 5 years of experience in product security, application security, or security architecture.
Proven ability to manage complex, high-stress incidents with clarity and authority and communicate technical crises in business terms to executive stakeholders.
Incident Response experience.
Proficiency in scripting with Python, Go, or PowerShell and familiarity with automation platforms.
Deep understanding of cloud-native infrastructure, including AWS, GCP, or Azure, and incident response in containerized Kubernetes or Docker environments.
Deep understanding of incident-handling lifecycles, including NIST 800-61, and attacker tactics, techniques, and procedures, including MITRE ATT&CK.

Nice To Haves

Background in DevOps, SRE, or Infrastructure Engineering, with an interest in applying those skills to Security.

Responsibilities

Serve as the primary Incident Commander for critical cybersecurity events, leading technical bridges, coordinating cross-functional resources, and maintaining clear communication to minimize business downtime.
Develop automation scripts and SOAR workflows to address repetitive threats and operationalize Security as Code.
Improve threat detection by treating logs as data pipelines and working with engineering teams to produce high-fidelity monitoring signals.
Lead blameless After-Action Reviews, perform root cause analysis, and translate findings into architectural improvements.
Build and refine integrations between security tools, including SIEM and EDR, and infrastructure tools such as CI/CD systems and cloud providers.
Participate in a structured on-call rotation to provide critical command coverage outside standard business hours and support rapid remediation.