Senior Staff Incident Response Engineer
SoFi · WA - Seattle; CA - San Francisco
About this role
**Employee Applicant Privacy Notice** **Who we are** Shape a brighter financial future with us. Together with our members, we’re changing the way people think about and interact with personal finance. We’re a next-generation financial services company and national bank using innovative, mobile-first technology to help millions of members reach their goals. **The role** As a **Senior Staff Incident Response Engineer** on the Cyber Defense team, you’ll serve as the principal technical authority and subject matter expert for incident response within SoFi’s Security Operations Center (SOC). You will lead investigations and mitigation actions against threats targeting crypto and digital asset platforms, while securing core enterprise and cloud infrastructure (AWS/GCP, applications, identity, and endpoints). This role sits within Incident Response (IR) in SoFi’s Cyber Defense organization. In partnership with the Cyber Incident Commander, you’ll handle high-severity incidents, architect containment workflows, and lead technical forensics across distributed systems. You’ll combine specialized digital asset threat knowledge with engineering skills to perform forensic triage, build automated investigation tools, and translate findings into hardened detection mechanisms and playbooks across the enterprise. **What you’ll do** - Serve as the SOC subject matter expert for digital asset and cryptocurrency security, investigating and neutralizing threats directed at digital asset platforms and services. - Apply blockchain investigation methods, forensic telemetry, and analytical tooling to execute scoping, containment, and recovery operations. - Investigate and resolve security alerts and incidents across digital asset, cloud, application, identity, and endpoint environments—driving issues from initial triage to root cause and remediation. - Perform forensic triage and deep data study (cloud/application log review, endpoint artifact inspection, evidence preservation, and timeline reconstruction). - Write clean, maintainable code (Python, Go, or SQL) to test large datasets, correlate telemetry across disparate log sources, and automate evidence collection/enrichment workflows. - Partner with Detection Engineering, Application Security, and Core Infrastructure teams to construct and tune threat detections, address logging gaps, and track systemic remediations to completion. - Partner with SOC analysts and the Cyber Incident Commander on incident operations, providing technical direction on complex investigations and high-severity incidents. - Develop and maintain crypto-specific and cloud-specific incident response runbooks and response procedures. - Document investigations thoroughly and deliver technical findings and post-incident reviews to technical and executive stakeholders. - Lead technical simulations and tabletop exercises covering digital asset and smart contract failure modes. - Evaluate and engineer automation tooling (SOAR and AI-assisted investigation workflows) to increase response efficiency, consistency, and coverage. - Mentor engineers, conduct peer reviews, and elevate SOC technical standards through threat education and reusable software tooling. **What you’ll need** - Bachelor’s degree + 4+ years of relevant experience **OR** Master’s degree + 3+ years of relevant experience. - 8+ years of total experience in incident response, security operations, or related security engineering functions within enterprise environments. - Prov
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.