Staff Security Engineer, Security Incident Response

1Password is a cybersecurity company building secure identity, application access, and device trust solutions for businesses. The Staff Security Engineer will provide senior technical leadership for security incident response, lead complex incidents, build AI-assisted response systems, and advance readiness, threat hunting, and insider risk capabilities.

Responsibilities:

• Serve as incident manager and technical escalation point for complex, high-severity events, bringing structure, sound judgement, and clear decision-making under pressure
• Design and build AI-assisted and automated systems that improve how quickly and consistently the team can triage, investigate, and contain incidents
• Establish appropriate safety controls, approval gates, auditability, and rollback mechanisms for automated and AI-assisted actions, ensuring high-impact decisions remain appropriately human-controlled
• Own the team's readiness programs, including tabletop exercises and incident gamedays, from scenario design and execution through debriefing and translating finishes into concrete (or measurable) improvements
• Advance the team’s threat hunting and insider risk capabilities by identifying opportunities, defining priorities, and delivering roadmap work that improves investigative depth and coverage
• Plan, sequence, and deliver multi-quarter initiatives that mature the team's capabilities, bringing project management discipline to work that doesn't fit neatly into a sprint
• Mentor and provide technical leadership to other engineers, strengthening engineering rigor and investigative judgement across the team
• Partner with Security Operations, Product Security, and Engineering teams to close gaps surfaced through investigations, hunting, and simulations
• Foster psychological safety and blameless learning across incident retrospectives, gamedays, and tabletop debriefs
• Extend strong incident response practices beyond the immediate team by building reusable systems, tooling, and operating patterns that strengthen response capabilities across areas such as PSIRT, Privacy, and Engineering

Requirements:

• Significant experience leading complex, high-severity security incidents across multiple environments, including serving as an incident commander or equivalent technical lead
• Experience designing and building AI-assisted or agentic automation for security operations (triage, investigation, containment), with sound judgment about where automation should and shouldn't hold decision authority
• Strong software engineering skills, and experience building production tooling, automation, or systems rather than only operating existing security platforms
• Experience owning a security program or capability roadmap end to end, including planning, sequencing, and delivering multi-quarter work
• Strong understanding of cloud-native, SaaS, and identity-driven attack techniques and response approaches
• Experience designing and running tabletop exercises, gamedays, or comparable readiness programs and translating findings into improvements
• Strong written and verbal communication skills, including the ability to represent technical tradeoffs to senior leadership and cross-functional stakeholders
• Experience mentoring engineers or otherwise raising the technical and investigative capabilities of a team
• This is a remote opportunity within Canada and the US
• Our approach to remote work We believe in the power of remote work, but recognize that in-person connection is important to help us achieve our mission. While we are a remote-first company, travel for in-person engagement is a part of almost all roles, and we require our employees to be ready and willing to take part. Frequency will depend on role and responsibilities, and may include, but is not limited to: annual department-wide offsites, team meetings, and customer/industry events
• Remote work at 1Password does mean working from your home country