incident-response jobs in San Diego

Lead a world-class Mobile Platform Engineering organization at ServiceNow, owning the technical roadmap for enterprise mobile capabilities across iOS and Android. You will hire and mentor exceptional mobile and AI talent, establish reusable frameworks and SDKs, architect enterprise mobile experiences for offline-first and low-connectivity environments, and drive reliability, security, and performance standards.…See more This role requires 12+ years of software engineering with significant mobile leadership experience, deep technical knowledge of mobile architecture, APIs, distributed systems, and cloud-native services, plus hands-on experience building or integrating generative AI and LLM-powered features into mobile applications.

Lead complex cybersecurity engagements for Chemicals & Natural Resources clients, managing workstreams across cyber defense, risk management, compliance, and operational technology security. Develop and deliver cybersecurity strategies tailored to chemical, oil & gas, mining, and agricultural enterprises, with deep expertise in both IT and OT environments.…See more Coordinate cross-functional project teams, manage budgets and deliverables, and serve as primary stakeholder contact for translating client security priorities into actionable solutions. Guide clients through secure adoption of AI/ML, OT modernization, supply chain digitization, and IT/OT convergence while maintaining regulatory compliance and operational resilience.

The Cybersecurity Engineer III will support Assessment and Authorization accreditation efforts, maintaining cybersecurity monitoring operations, performing incident triage, and identifying vulnerabilities with remediation recommendations. The role requires deep knowledge of the Risk Management Framework and involves testing and applying security controls, conducting reconnaissance, authoring Plans of Milestones and Actions (POA&Ms), and developing A&A documentation including System Security Plans, Security Assessment Plans, and Security Assessment Reports.…See more Responsibilities include managing eMASS scheduled tasking, quarterly STIG checks, annual security reviews, and maintaining DISA circuit connections and system inheritance workflows. The candidate must hold or obtain a Secret clearance and possess one of several IAM Level II certifications (CASP+, CAP, CISM, CISSP, or GSLC) with 10+ years of cybersecurity or incident response experience.

The Cybersecurity Engineer III will support Assessment and Authorization (A&A) accreditation efforts, maintaining cybersecurity monitoring operations, performing incident triage, identifying vulnerabilities, and recommending remediation strategies. The role requires deep expertise in the Risk Management Framework, including designing and tailoring security controls, conducting reconnaissance, authoring Plans of Milestones and Actions (POA&Ms), and developing comprehensive A&A documentation (SSP, SAP, SARs).…See more Responsibilities include adherence to eMASS scheduled tasking, quarterly IV&V and STIG checks, annual security reviews, monthly POA&M updates, and managing DISA circuit connections and inheritance workflows. The position requires 10+ years of cybersecurity or incident-response experience and one of several security certifications (CASP+, CAP, CISM, CISSP, or GSLC).

Design and build production AI systems integrated into enterprise workflows, owning the full stack from APIs and backend services through cloud infrastructure, data pipelines, and AI components. Lead multidisciplinary engineering teams, make architectural decisions across cloud platforms (AWS, Azure, GCP), containers, serverless, and infrastructure-as-code, while building agentic systems with tools, memory, and safety controls.…See more Own DevSecOps practices including CI/CD automation, security scanning, and incident response. Require 5+ years of production software engineering, full-stack development across multiple layers, hands-on experience with a major cloud platform, and proficiency in languages like Java, Python, Go, TypeScript, or C#.

An Associate Cybersecurity Engineer will monitor security alerts from SIEM, EDR, and IDS/IPS tools to detect and triage security incidents, then investigate confirmed events and support containment and recovery efforts. The role includes threat analysis, vulnerability validation, security awareness training administration, and phishing simulation campaign execution.…See more The engineer will document investigations, maintain runbooks and playbooks, and collaborate with Security, IT, and DevOps teams while supporting compliance frameworks (SOC 2, ISO 27001, PCI DSS).

This is a hands-on Solution Architect role for an AI-enabled Managed Services team, requiring deep technical expertise in designing end-to-end application architectures spanning UI, APIs, services, data, and AI components. The role combines hands-on coding and prototyping with architecture ownership, emphasizing active participation in codebases, AI tool evaluation, and guiding engineering teams through complex technical decisions.…See more Key responsibilities include designing reference architectures for AI patterns (RAG, vector search, prompt orchestration), defining non-functional requirements (performance, reliability, security), architecting CI/CD pipelines, and ensuring production readiness. The ideal candidate has 8+ years of software engineering experience, strong cloud-native and modern application architecture knowledge, practical AI feature development, and comfort working directly in code and infrastructure.

Lead high-severity incident investigations, mentor L1/L2 analysts, and drive detection engineering at a cybersecurity services firm. Responsibilities include threat hunting, malware analysis, digital/network forensics, SIEM/EDR tuning (KQL, SPL, Sigma, YARA), playbook development, and automation scripting in Python/PowerShell/Bash.…See more This is a 5+ year senior incident responder role requiring deep hands-on expertise across the full incident response lifecycle, MITRE ATT&CK, and client-facing technical briefings.

Senior Software Engineer responsible for designing and operating Affirm's analytical data platform, including secure data access patterns, CI/CD integration, self-service automation, and observability infrastructure. The role requires hands-on expertise with cloud data platforms (Snowflake, Databricks, BigQuery), containerization, API integrations, and Python/SQL backend work.…See more You'll participate in on-call coverage, triage production incidents, and help build next-generation capabilities including semantic layers and AI-native data tooling while setting high engineering standards across the platform.

Senior Application Security Engineer responsible for building and tuning Turquoise's application security scanning program (SAST, DAST, SCA, container, IaC scanning) and triaging findings from scans, penetration tests, and bug bounties. Day-to-day work includes partnering with engineering teams to remediate vulnerabilities, performing threat modeling, maintaining secure-coding standards, and supporting incident response for application-layer issues.…See more Requires 5+ years in application security or software engineering with security focus, deep hands-on experience with scanning tools, strong understanding of OWASP Top 10 and common vulnerability classes, and experience securing cloud environments and CI/CD pipelines.

Design and build secure cryptographic services (key management, PKI, secrets distribution) for ServiceNow's multi-tenant SaaS platform, ensuring FIPS compliance and regulated-environment requirements. Apply ML/statistical techniques to detect cryptographic misuse, anomalies in key usage, and suspicious access patterns in near real-time.…See more Operate services on Kubernetes, manage CI/CD pipelines, handle on-call duties, and collaborate with security architects to translate compliance requirements into production code. Requires 4+ years of production software engineering (Java, Go, or equivalent OO language), deep knowledge of distributed systems and cryptographic primitives, and hands-on Kubernetes deployment experience.

VP of Corporate IT responsible for developing and executing enterprise IT strategy, building and leading a high-performing Corporate IT organization, and advising executive leadership on technology, security, and operational risk. The role encompasses enterprise applications, employee technology, infrastructure, identity and access management, security operations, vendor management, and driving automation and cost efficiency across corporate systems.…See more Requires 15+ years of progressive IT leadership experience, including demonstrated success building or improving enterprise IT operating models in complex, regulated, or security-sensitive environments.

Design, build, and operate secure, scalable DevOps platforms at enterprise scale, with deep expertise in Kubernetes, Jenkins, Docker, and CI/CD infrastructure. Manage containerized workloads, implement monitoring and observability, provision and operate AWS infrastructure, and ensure platform reliability through incident response and capacity planning.…See more The role requires 3+ years of IT experience (or 5+ without a degree) with strong Linux administration, hands-on Kubernetes and Docker expertise, Jenkins infrastructure administration at scale, and CI/CD platform knowledge. This is a hands-on engineering role focused on platform reliability, security hardening, and developer enablement.

As a Managed Services Engineer II (L1 SOC Analyst) on Deloitte's Cyber Operate team, you will monitor security alerts from SIEM and other security tools, validate and escalate incidents within SLA timeframes, investigate suspected threats, and perform IOC searches. You will respond to security events using documented procedures, distinguish false positives from genuine incidents, coordinate with escalation paths, and maintain runbooks and shift handover documentation.…See more The role requires a Bachelor's degree in IT/Computer Science plus 1+ years of security operations or cybersecurity experience, hands-on familiarity with SIEM platforms, IDS/IPS, EDR, DLP, WAF, firewalls, and threat intelligence, and the ability to work rotating 24/7 shifts from a Deloitte office 50% of the time.

Research Cybersecurity Analyst at San Diego State University responsible for reviewing research proposals, contracts, and data-use agreements to identify cybersecurity and compliance requirements; conducting risk assessments and recommending remediation strategies; coordinating security controls across cloud and on-premises research environments; and developing compliance documentation (SSPs, POA&Ms) to support audits and assessments. The role requires interpreting security frameworks (NIST SP 800-171, CMMC, NIST SP 800-53) and communicating technical requirements to researchers and non-technical stakeholders while evaluating security architectures, access controls, encryption, and vulnerability management.See more

The Cyber Security Analyst develops and maintains assessment documentation, performs ongoing compliance assessments using tools like ACAS, SCAP, and Trellix, and conducts security audits and Site Based Security Assessments (SBSAs) of NCS Family of Systems. The role requires 5–8 years of cybersecurity experience, current DoD 8140-compliant IAT II certification (Security+ with appropriate CE/OS), and expertise in Risk Management Framework (RMF) v3/v5, System Security Plans (SSPs), POA&Ms, STIG remediation, and eMASS.…See more Responsibilities include patching verification, configuration and change management compliance, incident reporting, continuous monitoring, and potential appointment as Information System Security Officer (ISSO) within 6 months.

Lead the design and implementation of enterprise security enforcement technologies, including SIEM platforms, endpoint security, threat detection, and incident response systems. Develop and maintain a forward-looking cybersecurity technology roadmap aligned with NIST frameworks and business objectives, evaluating emerging threats and technologies to strengthen organizational security capabilities.…See more Conduct threat hunting, penetration testing, and detection engineering activities while driving automation of security controls, policy enforcement, and response across complex technology environments. Mentor cybersecurity teams and influence enterprise security strategy across large organizations, with demonstrated experience securing AI-enabled solutions and understanding AI-specific security considerations.

Lead cybersecurity operations for Naval Surface Warfare Center Corona enclaves and Platform IT systems, owning the complete Risk Management Framework (RMF) Authorization to Operate process under DoD Instruction 8510.01. Oversee ISSOs and System Administrators, develop and maintain System Security Plans, Security Assessment Reports, and Risk Assessment Reports, and manage eMASS records for continuous compliance monitoring.…See more Direct incident response, enforce configuration management policies through Change Control Boards, and conduct STIG/ACAS/SCAP compliance reviews. Requires TS/SCI clearance, Master's in Computer Science/Cybersecurity or equivalent, 8+ years cybersecurity experience, and current DoD 8140/8570 Level III certification (CISSP, CISM, CASP+, or equivalent).

Lead cybersecurity program delivery for NSWC Corona's Risk Management Framework and continuous authorization services. Manage a team of ISSMs, ISSOs, and cybersecurity analysts while serving as primary interface with Navy leadership and government stakeholders.…See more Oversee contract lifecycle, financials, and compliance across A&A packages and continuous monitoring; drive process improvements in eMASS workflows and RMF execution. Provide strategic guidance on DoD/Navy cybersecurity policy, emerging threats, and system acquisition integration.

Senior manager responsible for leading Deloitte's identity and access management (IAM) managed services delivery across multiple client accounts. The role requires 10+ years of IAM experience with 5+ years in managed services or IT operations leadership, hands-on expertise with platforms like SailPoint, CyberArk, Okta, or Entra ID, and the ability to drive service improvement through automation and modernization.…See more Responsibilities include account ownership, executive governance, financial performance management, team mentorship, and business development activities such as contract renewals and proposal response.

The IT Manager will lead all IT infrastructure, cybersecurity, and regulatory compliance operations for a healthcare organization. Key responsibilities include designing and maintaining secure cloud, network, and endpoint systems; serving as the HIPAA compliance authority; establishing incident response procedures; managing vendor and third-party risk; and providing executive advisory on technology strategy and risk.…See more The role demands extensive IT/cybersecurity leadership experience, deep HIPAA and healthcare data-protection expertise, and the ability to build compliance frameworks and security controls from the ground up.

As Manager of the Business Systems team, you'll lead systems analysts and administrators while managing strategic projects involving CRM, ERP, reporting, and internal platforms. You'll drive complex implementations, data migrations, integrations, and upgrades while managing project plans, timelines, budgets, vendor relationships, and cross-functional stakeholders.…See more Success requires 5+ years of management experience focused on business systems implementations and 5+ years of systems administration or analyst experience, with expertise in platforms like Salesforce, Zuora, or HubSpot and project methodologies including Agile and Waterfall.

Staff Data Engineer at Qualcomm responsible for designing, building, and maintaining scalable batch and streaming data pipelines on AWS and Databricks. Develop reusable data engineering frameworks, libraries, and templates while implementing AI-driven automation for schema inference, data quality checks, pipeline orchestration, and self-healing mechanisms.…See more Lead reliability and operations efforts by defining SLIs/SLOs, participating in incident response, and driving performance tuning and cost optimization. Mentor junior engineers, collaborate across analytics and platform teams, and drive adoption of standardized data frameworks and best practices.

Lead the security architecture for satellite onboard systems, designing secure boot chains, attestation mechanisms, and trust boundaries across hardware, firmware, and payload compute. You will conduct threat modeling, implement Hardware Root of Trust solutions (TPM, secure elements, eFuse), manage firmware signing processes, and develop incident response procedures for onboard system compromise.…See more The role requires close collaboration with hardware and firmware teams to embed security best practices throughout the platform development lifecycle, plus mentoring and recruiting for the security organization.

Senior Staff Lead Site Reliability Engineer to establish and mature SRE practices across Hivemind's cloud infrastructure and platform services. You will define reliability targets (SLIs/SLOs), build observability systems, lead incident response and root-cause analysis, mentor teams on reliability-first practices, and develop automation to reduce manual operational work.…See more The role requires 7+ years in SRE or infrastructure engineering, hands-on experience operating production services in AWS or equivalent cloud environments, expertise with containerized/distributed systems, infrastructure-as-code, and operational tooling development in Python or Go.