incident-response jobs in San Diego

Lead detection operations, incident response, and security operations maturation for a growing security team. Operate SIEM/XDR across endpoint, cloud, identity, network, and SaaS telemetry; conduct complex investigations; tune detections; and drive root-cause analysis and post-incident improvements.…See more Require 6+ years of hands-on security operations, detection engineering, or incident response experience with deep proficiency in SIEM/XDR query languages, EDR platforms, scripting (Python, PowerShell, Bash), and MITRE ATT&CK framework application. Mentor analysts, define playbooks and runbooks, lead threat hunts, and own SecOps metrics and operational-readiness reporting.

The Cybersecurity Engineer III will support Assessment and Authorization (A&A) accreditation efforts, including maintaining cybersecurity monitoring operations, performing incident triage, identifying vulnerabilities, and recommending remediation strategies. Responsibilities include testing and applying security controls, conducting reconnaissance, authoring Plans of Milestones and Actions (POA&Ms), developing A&A documentation (SSP, SAP, SARs), and managing eMASS tasking throughout the accreditation cycle.…See more The role requires in-depth knowledge of the Risk Management Framework, DISA circuit connections, and cloud service provider inheritance. This position requires a Secret clearance, IAT Level III certification, and one of several advanced certifications (CASP+, CCNP Security, CISA, CISSP, GCED, or GCIH), plus 10+ years of cybersecurity or incident response experience.

This cybersecurity engineer role focuses on securing cloud infrastructure (AWS, Azure, GCP), containerized environments (Docker, Kubernetes), and applications through vulnerability management, risk assessment, and security architecture review. The position requires hands-on experience with SIEM, EDR, WAF configuration, and embedding security scanning (SAST, DAST, SCA) into CI/CD pipelines.…See more The engineer will conduct threat modeling, manage IAM policies, perform penetration testing coordination, support incident response and post-incident reviews, and partner with engineering teams to balance security with delivery. The role also includes compliance support, vendor risk assessments, and serving in an on-call rotation for after-hours security incidents.

This role manages a large technical team supporting Navy-Marine Corps Intranet (NMCI) network operations under the SMIT contract. The engineer will lead field/base network operations including BAN/LAN/WAN troubleshooting, installation, configuration, cabling, and COMSEC support across DOD enterprise network environments.…See more Responsibilities include incident response, change management, problem management, and DevSecOps initiatives, with direct customer interaction and resource management. The position requires extensive operations/engineering leadership experience, solid network architecture knowledge, and hands-on proficiency in fault diagnosis, repair, and passive infrastructure work.

The Information Systems Security Manager (ISSM) will lead organizational information security strategy, frameworks, and compliance across defense and classified environments. Responsibilities include developing and maintaining security policies aligned with NIST SP 800–171, DFARS, and ISO 27001; leading CMMC and ISO 27001 certification efforts; managing CUI and classified information handling; conducting risk assessments and vulnerability analyses; overseeing incident response; and serving as the primary liaison with government agencies and customers on security compliance.…See more The role requires 7+ years of information security management experience, with 3+ years in a leadership capacity, and deep expertise in NIST, DFARS, DISA-STIGs, ISO 27001, classified information protocols, and risk governance.

The Information Systems Security Manager will develop, implement, and maintain the company's information security policies and compliance programs aligned with NIST SP 800-171, DFARS, ISO 27001, and CMMC requirements. Responsibilities include overseeing Controlled Unclassified Information (CUI) and classified information protection, conducting risk assessments and vulnerability analyses, leading incident response efforts, and serving as primary liaison with government agencies on compliance matters.…See more The role requires 7+ years of information security management experience with at least 3 years in a leadership position, and extensive knowledge of defense industry security standards and classified information handling protocols. The ISSM will collaborate with DevSecOps, IT, and engineering teams to integrate security controls across operations and maintain continuous Authority to Operate (cATO) pipelines.

Lead a large technical team supporting Navy-Marine Corps Intranet (NMCI) operations under the SMIT contract, managing network infrastructure, incident response, change management, and O&M initiatives. Perform hands-on network engineering including troubleshooting, installation, configuration, cabling, and COMSEC support across BAN/LAN/WAN environments.…See more Analyze network architectures, diagnose faults, manage customer relationships, and execute projects in a fast-paced DOD enterprise network environment. Requires extensive operations/engineering leadership experience with network/transport technical background and DOD enterprise network knowledge.

Lead a group of managers and 30+ engineers across Intuit's tax platform organization, owning the technical vision and roadmap for tax engines, runtime platforms, and Tax Prep APIs. Set technical direction, drive reliability and performance improvements, and embed AI/GenAI capabilities into the platform while maintaining compliance and correctness standards.…See more Manage, coach, and develop engineering managers; build talent systems including hiring, succession planning, and performance calibration. Partner cross-functionally with Product, Design, and AI leaders to shape strategy and resolve systemic friction points affecting tax prep quality.

This role is a hands-on cybersecurity engineer responsible for securing cloud infrastructure (AWS, Azure, GCP), containerized environments (Docker, Kubernetes), and applications. Key duties include vulnerability scanning and penetration testing, threat modeling, Web Application Firewall (WAF) deployment and tuning, CI/CD security integration (SAST, DAST, SCA), incident response, and compliance support.…See more The engineer will work closely with DevOps and application teams to embed security controls, conduct code and architecture reviews, and provide risk-based guidance. Required experience includes 3–5+ years in cybersecurity or security engineering, hands-on SIEM/EDR/vulnerability management tools, cloud platforms, WAF configuration, and scripting (Python, Bash, PowerShell).

The Senior Systems Analyst serves as UC San Diego's Division of Extended Studies' senior technical authority, applying advanced IT concepts to resolve complex challenges across the division's technology ecosystem, including its public-facing website, CRM platform (Element451), campus integrations, and custom-built applications. The role involves leading remediation of legacy applications, conducting hands-on analysis of current business processes, defining future-state solutions across critical systems and workflows, and maintaining/optimizing configurations across all vended solutions.…See more Reporting to the Assistant Dean of Finance & Administration, the incumbent collaborates closely with the DES IT team to support the division's $50M annual budget, 260+ staff, and 90,000+ annual enrollment transactions.

A Senior Site Reliability Engineer at SHEIN will own and operate mission-critical, large-scale distributed systems (Kubernetes, Kafka, Elasticsearch, Redis, APISIX, Nginx) running 24/7/365, participating in on-call rotations and driving fast incident response using AI-assisted log analysis and anomaly detection. The role requires strong software engineering expertise in Python or Go, deep Linux and networking knowledge, and hands-on experience with observability platforms (Prometheus, Grafana) and configuration management tools.…See more Responsibilities include designing resilient monitoring and alerting infrastructure, automating operational workflows to eliminate toil, capacity planning, and collaborating with global teams to improve system reliability and performance.

Principal Solution Architect driving technical and strategic leadership of LPL Financial's ClientWorks advisor platform. Architect cloud-native, scalable solutions spanning account opening, client management, trading, reporting, and design systems while ensuring security, compliance, and seamless third-party integration.…See more Lead cross-functional teams in modern architecture practices, DevSecOps, and CI/CD automation; mentor development teams and evangelize architectural standards across hybrid enterprise environments.

Lead a team of cloud engineers building the nervous system for Brain Corp's fleet of 30,000+ autonomous mobile robots. Own the platform's reliability, roadmap, and architecture while managing team hiring, onboarding, and career development.…See more Drive high-performance delivery across robot and customer-facing interfaces, balance competing priorities (performance, cost, reliability, scalability), and partner with principal and staff engineers on long-term platform strategy. Stay hands-on enough to make sound architectural decisions and earn senior engineer trust during a period of significant growth.

Lead a team of cloud engineers building the backend platform that powers Brain Corp's global fleet of 30,000+ autonomous mobile robots. Own the platform's reliability, roadmap, and architecture as it scales to support fleet operations and customer-facing applications.…See more Balance hands-on technical leadership with people management—mentor engineers, drive hiring and onboarding, own production reliability and incident response, and partner with principal/staff engineers on distributed-systems architecture. Navigate tradeoffs between performance, cost, reliability, and scalability while shipping features that robots in the field depend on.

Senior Site Reliability Engineer responsible for designing and implementing Infrastructure as Code solutions, managing containerized and serverless architectures, and driving automation to reduce operational toil across large-scale production systems. The role requires defining Service Level Objectives (SLOs), leading incident response efforts, implementing monitoring and logging systems, and collaborating with development teams to ensure reliability and scalability.…See more Requires 5+ years of SRE or cloud engineering experience with deep expertise in Terraform, CloudFormation, Docker, Kubernetes, CI/CD pipelines, and cloud security practices. Must be a US citizen eligible to obtain and maintain an active Secret security clearance or above.

This role manages a cybersecurity program for clinical medical technology (diagnostic imaging and therapeutic radiation equipment) at a healthcare organization. The manager will lead staff, oversee regulatory compliance, conduct risk assessments and incident response, ensure HIPAA and Joint Commission adherence, and collaborate with clinical teams on technology security and reliability.…See more The position requires 3+ years of management experience, 5+ years in related healthcare technology work, and a bachelor's degree, with responsibility for budget, purchasing, and business operations.

Design and implement Infrastructure as Code to automate provisioning, monitoring, and lifecycle management of NoSQL, Streaming, and Caching platforms (Cassandra, Aerospike, Kafka, Redis) across AWS and GCP. Build highly available, self-healing systems with automated failover and scaling, develop comprehensive observability solutions, and lead incident response for critical data platform issues.…See more Drive automation-first practices and apply AI/ML approaches such as anomaly detection and predictive scaling to enhance reliability and reduce manual toil. Partner with engineering and platform teams to ensure resilient infrastructure supporting billions of transactions and millions of players globally.

This is a hands-on security engineering role focused on running Saronic's cyber threat intelligence program. The engineer will track nation-state and advanced criminal adversaries targeting the defense industrial base, operationalize indicators and TTPs into detections and hunts, produce finished intelligence products, and fuse external threat feeds with internal telemetry to prioritize real exposures.…See more The role requires 4+ years in cyber threat intelligence, threat hunting, detection engineering, or intrusion analysis with demonstrable experience tracking sophisticated or state-sponsored adversaries.

The Senior Systems Administrator designs, implements, and maintains enterprise IT infrastructure across cloud, endpoint, identity, server, and collaboration platforms. Responsibilities include administering Windows, Linux, and macOS systems; managing Active Directory, Azure AD/Entra ID, and endpoint platforms like Intune and JAMF; optimizing system performance and reliability; and developing automation scripts.…See more This role requires 5+ years of enterprise infrastructure experience, advanced knowledge of Microsoft identity and collaboration services, and acts as a technical lead for infrastructure projects while mentoring junior administrators.

OWT Global seeks a Cybersecurity Analyst to serve as technical authority for ServiceNow platform security, ensuring compliance with federal cybersecurity protocols including NIST SP 800-53 and DoD RMF. Responsibilities include mapping ServiceNow roles and access controls to compliance frameworks, developing and maintaining System Security Plans (SSP) and POA&Ms, supporting vulnerability management and security assessments, and providing advisory support to government personnel on cybersecurity matters.…See more The role requires five years of practical cybersecurity experience, a Bachelor's degree in Cybersecurity or related field, and relevant certifications (CISSP or Security+ preferred), with strong understanding of ServiceNow architecture and DoD RMF processes.

Design, implement, and maintain secure DevSecOps automation frameworks across on-premise and cloud infrastructure, integrating security controls into CI/CD pipelines for application and configuration deployment. Develop Infrastructure as Code using Terraform, Ansible, ARM/Bicep, PowerShell, Python, and Bash across Windows, Linux, VMware, Azure, and hybrid environments.…See more Automate provisioning, patching, vulnerability remediation, and compliance checks aligned with FFIEC, NCUA, CIS, and NIST standards while partnering with Cybersecurity, Infrastructure, and Application Development teams. Support container/platform engineering, cloud identity governance, and promote DevSecOps and GitOps practices across technology teams.

This role leads enterprise IT infrastructure and operations for a defense technology company, overseeing networks, cloud environments, endpoints, identity and access management, and end-user services. The Director will develop IT strategy aligned with DoD customer requirements, advise leadership on cybersecurity risk and IT modernization, and ensure compliance with CMMC, NIST SP 800-171, DFARS, and RMF standards.…See more Responsibilities include managing IT governance, disaster recovery, vendor relationships, budgets, and supporting protection of Controlled Unclassified Information through security assessments and incident response. The role requires leading and mentoring IT and DevOps teams managing infrastructure including cloud environments.

Own the complete release and deployment strategy for Elemynt's secure AI infrastructure platform, building systems that ensure every release is versioned, reproducible, observable, and safe to operate across enterprise and scientific computing environments. Design and implement deployment automation, CI/CD pipelines, artifact management, and operational visibility (logs, metrics, alerts) that work reliably in customer-managed and restricted environments.…See more Debug incidents, identify root causes, and systematize fixes into reusable automation. Partner with product and engineering teams to embed deployment readiness into the platform from the start.

Field/Base Network Engineer managing large technical teams and Navy-Marine Corps Intranet (NMCI) operations under the SMIT contract. Responsibilities include BAN/LAN/WAN network operations, troubleshooting, repair, installation, cabling, configuration, and COMSEC support; managing incident response, change management, and problem management initiatives.…See more Requires extensive operations/engineering leadership experience, working knowledge of large DoD enterprise network environments, and hands-on technical background in network architectures, fault diagnosis, and ITSM/DevSecOps. Physical role involving equipment installation, rack mounting, confined-space work, and site-based troubleshooting across multiple locations.

Lead operational service delivery for enterprise Web Application Firewall (WAF), load balancing, DNS, certificates, and edge security platforms. Own end-to-end service performance, SLA/KPI metrics, incident escalation, and cross-team coordination across application, cloud, networking, and security teams.…See more Manage and develop senior and staff-level engineers, drive operational governance, risk management, and continuous improvement. The role requires sufficient technical depth to guide platform designs, direct incident response, and make informed operational decisions, though not necessarily performing all configurations personally.