{"id":64062,"url":"https://alion.io/job/f5-principal-security-engineer-incident-response","title":"Principal Security Engineer - Incident Response","company":{"id":5759,"name":"F5","domain":"f5.com","url":"https://alion.io/company/ffive","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":81,"open_postings":20,"ghost_share":0,"stale_share":0.75,"repost_share":0,"time_to_fill_p50_days":43,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Seattle, United States","San Jose, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":182200,"max":273200,"currency":"USD","period":"year","gross":null,"usd_annual":273200},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Commander.js","optional":false},{"name":"Crowdstrike","optional":false},{"name":"FedRAMP","optional":false},{"name":"GCP","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Nginx","optional":false},{"name":"PCI DSS","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"SOC 2","optional":false},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true}],"status":"live","first_seen_at":"2026-08-19T00:00:00Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-17T08:02:02Z","board_verified":true,"closed_at":null,"days_open":59,"trust":{"level":"ok","repost_count":1,"flags":[],"days_open":59},"description":"At F5, we strive to bring a better digital world to life. Our teams empower organizations across the globe to create, secure, and run applications that enhance how we experience our evolving digital world. We are passionate about cybersecurity, from protecting consumers from fraud to enabling companies to focus on innovation. \nEverything we do centers around people. That means we obsess over how to make the lives of our customers, and their customers, better. And it means we prioritize a diverse F5 community where each individual can thrive.\nPrincipal Security Engineer - Incident Response & Crisis Management\nOrganization: F5 Office of the CISO | Application Delivery, Security, and AI Resilience\nEligibility: U.S. Citizenship Required (FedRAMP Authorization & Compliance)\nPosition Summary\nWe are seeking a Principal Security Engineer / Incident Response Lead to serve as the Incident Commander and strategic program lead within the Office of the CISO. In this senior role, you will orchestrate enterprise-scale response efforts, drive cyber crisis management, and elevate incident response maturity across F5’s corporate infrastructure, hybrid multicloud environments, core product lines (BIG-IP, NGINX, Distributed Cloud, WAAP), and emerging AI-enabled services.\nYou will act as the primary escalation point during high-impact security events, translating complex forensic investigations into clear executive communications and driving cross-functional alignment across Engineering, SRE, Legal, Communications, and Executive Leadership.\nKey Responsibilities\nIncident Command & Cyber Crisis Leadership\nServe as the Incident Commander for enterprise-wide, high-severity cyber and product security incidents from detection through post-incident review.\n\nDefine and lead response workstreams, coordinate cross-functional teams, and maintain executive visibility throughout crisis resolution.\n\nOn-Call Availability: Participate in and lead the rotating 24/7 on-call escalation rotation for major security incidents.\n\nIR Program Strategy & AI Security Readiness\nOwn and evolve F5’s global Incident Response roadmap, playbooks, severity matrix, governance standards, and executive metrics.\n\nArchitect incident response frameworks for AI-enabled applications, LLMs, AI gateways, APIs, and model runtime data paths.\n\nDrive AI-assisted security operations, automated triage, and response orchestration to eliminate manual overhead.\n\nExecutive Stakeholder & Regulatory Engagement\nAuthor high-impact technical summaries, root-cause analyses (RCAs), customer notifications, and board-level briefing materials.\n\nRepresent the Incident Response program in compliance audits, regulatory reviews, and key customer escalations.\n\nOperational Resilience, Metrics & Mentorship\nDefine and track key resilience metrics (MTTD, MTTC, MTTR, blast-radius reduction) and conduct high-fidelity tabletop simulations.\n\nMentor security engineers and incident responders, establishing technical standards, investigation playbooks, and operational best practices.\n\nQualifications & Requirements\nCitizenship & Compliance (Mandatory)\nMust be a U.S. Citizen (required to support F5’s FedRAMP authorization, federal compliance mandates, and government-regulated environments).\n\nExperience & Availability\n10+ years of progressive cybersecurity experience with deep expertise in Incident Command, SOC leadership, Threat Hunting, Product Security, or Digital Forensics in large-scale SaaS/cloud environments.\n\nWillingness and availability to participate in a rotating 24/7 on-call escalation schedule.\n\nTechnical Mastery\nAdvanced understanding of application delivery architectures, load balancing, reverse proxies, WAF/WAAP, API gateways, DDoS mitigation, and Kubernetes ingress security.\n\nProven expertise investigating complex telemetry across AWS/Azure/GCP, SIEMs, EDR platforms (e.g., CrowdStrike), identity providers, and network/edge devices.\n\nWorking knowledge of modern adversary tradecraft (MITRE ATT&CK), API attack vectors, and emerging AI/LLM threat landscapes.\n\nLeadership & Frameworks\nDemonstrated ability to command high-stress situations and influence senior engineering and executive stakeholders without direct authority.\n\nComprehensive familiarity with industry frameworks: FedRAMP, NIST SP 800-61 / 800-53, ISO 27001, SOC 2, and PCI-DSS.\n\nSuccess Measures (First 12-18 Months)\nMature and standardize global incident command playbooks across hybrid cloud and AI workloads.\n\nLead high-severity crisis investigations to swift containment while maintaining stakeholder trust and SLA adherence.\n\nDrive measurable improvements in MTTD/MTTR across enterprise and product environments.\n\nEnsure IR processes fully satisfy FedRAMP continuous monitoring and compliance requirements.\n\nThe Job Description is intended to be a general representation of the responsibilities and requirements of the job. However, the description may not be all-inclusive, and responsibilities and requirements are subject to change.\nThe annual base pay for this position is: $182,200.00 - $273,200.00F5 maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience, geographic locations, and market conditions, as well as to reflect F5’s differing products, industries, and lines of business. The pay range referenced is as of the time of the job posting and is subject to change.\nYou may also be offered incentive compensation, bonus, restricted stock units, and benefits. More details about F5’s benefits can be found at the following link: https://www.f5.com/company/careers/benefits. F5 reserves the right to change or terminate any benefit plan without notice.\nPlease note that F5 only contacts candidates through F5 email address (ending with @f5.com) or auto email notification from Workday (ending with f5.com ).\nEqual Employment Opportunity\nIt is the policy of F5 to provide equal employment opportunities to all employees and employment applicants without regard to unlawful considerations of race, religion, color, national origin, sex, sexual orientation, gender identity or expression, age, sensory, physical, or mental disability, marital status, veteran or military status, genetic information, or any other classification protected by applicable local, state, or federal laws. This policy applies to all aspects of employment, including, but not limited to, hiring, job assignment, compensation, promotion, benefits, training, discipline, and termination. F5 offers a variety of reasonable accommodations for candidates. Requesting an accommodation is completely voluntary. F5 will assess the need for accommodations in the application process separately from those that may be needed to perform the job. Request by contacting .","description_format":"text","description_chars":6788,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Restricted stock units"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Network Security","Application Security","Web Security & DDoS Protection"],"lifecycle":[{"event":"open","at":"2026-08-19T00:00:00Z"},{"event":"close","at":"2026-10-08T14:07:01Z"},{"event":"reopen","at":"2026-10-12T21:49:47Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"green card filings: 1","filings_12m":0,"filings_prev_12m":4,"green_card_filings_12m":1,"median_offered_wage_usd":197500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":21,"band":"cold","label":"Long shot","p_open":1,"p_active":0.475,"p_room":0.44,"age_days":59,"expected_fill_days":43,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":273200,"is_top_pay":true},"html_url":"https://alion.io/job/f5-principal-security-engineer-incident-response","json_url":"https://alion.io/job/f5-principal-security-engineer-incident-response.json","meta":{"generated_at":"2026-10-17T09:54:06Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13007,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5759},"rest":"https://alion.io/mcp/rest/get_company?id=5759"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ff5-principal-security-engineer-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ff5-principal-security-engineer-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ff5-principal-security-engineer-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/f5-principal-security-engineer-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ff5-principal-security-engineer-incident-response"}]}