Staff Security Engineer, Security Incident Response

1Password is hiring a Staff Security Engineer for its Security Incident Response team. The role leads complex security incidents and builds AI-assisted response systems, readiness programs, and longer-term capabilities in threat hunting and insider risk.

Responsibilities:

• Serve as incident manager and technical escalation point for complex, high-severity events, bringing structure, sound judgement, and clear decision-making under pressure
• Design and build AI-assisted and automated systems that improve how quickly and consistently the team can triage, investigate, and contain incidents
• Establish appropriate safety controls, approval gates, auditability, and rollback mechanisms for automated and AI-assisted actions, ensuring high-impact decisions remain appropriately human-controlled
• Own the team's readiness programs, including tabletop exercises and incident gamedays, from scenario design and execution through debriefing and translating finishes into concrete (or measurable) improvements
• Advance the team’s threat hunting and insider risk capabilities by identifying opportunities, defining priorities, and delivering roadmap work that improves investigative depth and coverage
• Plan, sequence, and deliver multi-quarter initiatives that mature the team's capabilities, bringing project management discipline to work that doesn't fit neatly into a sprint
• Mentor and provide technical leadership to other engineers, strengthening engineering rigor and investigative judgement across the team
• Partner with Security Operations, Product Security, and Engineering teams to close gaps surfaced through investigations, hunting, and simulations
• Foster psychological safety and blameless learning across incident retrospectives, gamedays, and tabletop debriefs
• Extend strong incident response practices beyond the immediate team by building reusable systems, tooling, and operating patterns that strengthen response capabilities across areas such as PSIRT, Privacy, and Engineering

Requirements:

• Significant experience leading complex, high-severity security incidents across multiple environments, including serving as an incident commander or equivalent technical lead
• Experience designing and building AI-assisted or agentic automation for security operations (triage, investigation, containment), with sound judgment about where automation should and shouldn't hold decision authority
• Strong software engineering skills, and experience building production tooling, automation, or systems rather than only operating existing security platforms
• Experience owning a security program or capability roadmap end to end, including planning, sequencing, and delivering multi-quarter work
• Strong understanding of cloud-native, SaaS, and identity-driven attack techniques and response approaches
• Experience designing and running tabletop exercises, gamedays, or comparable readiness programs and translating findings into improvements
• Strong written and verbal communication skills, including the ability to represent technical tradeoffs to senior leadership and cross-functional stakeholders
• Experience mentoring engineers or otherwise raising the technical and investigative capabilities of a team
• You're comfortable taking ownership of a capability from strategy through execution, including defining priorities, sequencing work, navigating dependencies, and delivering against a longer-term roadmap
• You can operate as a technical partner to leaders and cross-functional teams, independently representing technical priorities, risks, and tradeoffs