Senior Security Engineer, Incident Response

1Password is a cybersecurity company building secure identity, application access, and device trust solutions for businesses. The Senior Security Engineer, Incident Response will lead complex security investigations, coordinate incidents end-to-end, and build automation, systems, and workflows that improve the speed, reliability, and scalability of security operations.

Responsibilities:

• Lead and execute security incidents end-to-end, from initial signal through containment, recovery, and post-incident review
• Assess severity, declare incidents, and drive structured coordination and decision-making during active response
• Perform hands-on investigations and threat hunting to determine root cause, attacker behavior, scope, and impact
• Design and build automation to reduce triage, investigation, and response time
• Develop scalable systems and workflows that improve incident response and incident management
• Identify recurring pain points and detection/response gaps, and implement durable engineering solutions
• Improve incident response playbooks, case management, and orchestration tooling
• Apply AI-assisted tooling to enhance triage, enrichment, and investigative workflows while maintaining accuracy

Requirements:

• An experienced incident lead who can independently drive complex investigations and coordinate diverse stakeholders
• A builder who enjoys improving systems, automation, and workflows – not just responding to alerts
• Calm and decisive under pressure, with strong judgment in ambiguous or high-severity situations
• Structured and organized, with strong project management skills to own complex projects
• A clear communicator who can translate technical findings into actionable guidance for both technical and non-technical audiences
• A collaborative teammate who values blameless learning and psychological safety
• 5+ years of experience in security incident response roles, with 3+ years focused on security engineering and automation
• Proven experience leading complex security incidents in cloud-native or SaaS environments
• Experience building automation or internal tooling to improve security operations
• Proficiency in scripting or programming (e.g., Python, Go, Bash) and working with APIs or orchestration platforms
• Familiarity with applying AI/ML-assisted workflows to operational security use cases
• Strong understanding of modern attacker techniques and incident response methodologies
• Strong written and verbal communication skills, including executive-facing summaries
• This is a remote opportunity within Canada and the US
• travel for in-person engagement is a part of almost all roles, and we require our employees to be ready and willing to take part
• Remote work at 1Password does mean working from your home country