Principal Security Engineer - Incident Response
F5 Networks3 days ago
Seattle, WA, USA or San Jose, CA, USAStaff+
Base Salary
$182k - $273k/yr
Responsibilities
- Serve as Incident Commander for enterprise-wide, high-severity cyber and product security incidents.
- Define response workstreams, coordinate cross-functional teams, and maintain executive visibility during crisis resolution.
- Participate in and lead a rotating 24/7 on-call escalation rotation.
- Own and evolve the global incident response roadmap, playbooks, severity matrix, governance standards, and executive metrics.
- Architect incident response frameworks for AI-enabled applications, LLMs, AI gateways, APIs, and model runtime data paths.
- Drive AI-assisted security operations, automated triage, and response orchestration.
- Author technical summaries, root-cause analyses, customer notifications, and board-level briefings.
- Represent the Incident Response program in compliance audits, regulatory reviews, and customer escalations.
- Define resilience metrics, conduct high-fidelity tabletop simulations, and improve MTTD, MTTC, and MTTR.
- Mentor security engineers and incident responders and establish investigation standards and operational best practices.
Requirements
- U.S. citizenship is required to support FedRAMP authorization, federal compliance mandates, and government-regulated environments.
- At least 10 years of progressive cybersecurity experience with deep expertise in incident command, SOC leadership, threat hunting, product security, or digital forensics in large-scale SaaS or cloud environments.
- Availability and willingness to participate in a rotating 24/7 on-call escalation schedule.
- Advanced understanding of application delivery architectures, load balancing, reverse proxies, WAF/WAAP, API gateways, DDoS mitigation, and Kubernetes ingress security.
- Expertise investigating telemetry across AWS, Azure, GCP, SIEMs, EDR platforms such as CrowdStrike, identity providers, and network or edge devices.
- Working knowledge of MITRE ATT&CK, API attack vectors, and emerging AI/LLM threat landscapes.
- Ability to command high-stress situations and influence senior engineering and executive stakeholders without direct authority.
- Familiarity with FedRAMP, NIST SP 800-61, NIST SP 800-53, ISO 27001, SOC 2, and PCI-DSS.
Benefits
- The posting references F5 benefits, incentive compensation, bonuses, and restricted stock units; specific benefit details are provided through F5’s benefits page.
Tech Stack
Categories
About F5 Networks
F5, Inc. builds application delivery and security products for enterprises, service providers, and governments, spanning on‑premises, cloud, and edge environments. It sells software, hardware appliances, and SaaS subscriptions for load balancing, WAF, API security, DDoS protection, and traffic management, with support services. Founded in 1996 and headquartered in Seattle, the public company (NASDAQ: FFIV) expanded its portfolio through acquisitions including NGINX and Shape Security.