{"id":64063,"url":"https://alion.io/job/f5-security-engineer-incident-response","title":"Security Engineer - Incident response","company":{"id":5759,"name":"F5","domain":"f5.com","url":"https://alion.io/company/ffive","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":81,"open_postings":20,"ghost_share":0,"stale_share":0.75,"repost_share":0,"time_to_fill_p50_days":43,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Seattle, United States","San Jose, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":132000,"max":198000,"currency":"USD","period":"year","gross":null,"usd_annual":198000},"salary_estimate":null,"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Crowdstrike","optional":false},{"name":"FedRAMP","optional":false},{"name":"GCP","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Nginx","optional":false},{"name":"PCI DSS","optional":false},{"name":"SIEM","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-08-19T00:00:00Z","employer_posted_date":"2026-09-04","last_verified_at":"2026-10-17T08:02:02Z","board_verified":true,"closed_at":null,"days_open":59,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":59},"description":"At F5, we strive to bring a better digital world to life. Our teams empower organizations across the globe to create, secure, and run applications that enhance how we experience our evolving digital world. We are passionate about cybersecurity, from protecting consumers from fraud to enabling companies to focus on innovation. \nEverything we do centers around people. That means we obsess over how to make the lives of our customers, and their customers, better. And it means we prioritize a diverse F5 community where each individual can thrive.\nSecurity Engineer III - Incident Response\nOrganization:F5 Office of the CISO | Application Delivery, Security, and AI Resilience\nEligibility:U.S. Citizenship Required(FedRAMP Authorization & Compliance)\nPosition Summary\nWe are seeking aSecurity Engineer IIIto join the Office of the CISO as a core member of our Global Incident Response team. In this role, you will lead hands-on triage, containment, and resolution of complex security incidents across corporate infrastructure, multicloud environments, core products (BIG-IP, NGINX, Distributed Cloud, WAAP), and emerging AI-enabled services.\nYou will serve as an incident responder and workstream lead during active cyber events, partnering across engineering, SRE, cloud operations, legal, and executive leadership from initial triage through post-incident remediation.\nKey Responsibilities\nIncident Triage & Response Execution\nLead end-to-end response for high-severity cyber and product security incidents (detection, containment, eradication, and recovery).\n\nDrive incident command workflows, track mitigation workstreams, document forensic findings, and deliver clear technical updates to stakeholders.\n\nOn-Call Availability:Participate in a scheduled,rotating 24/7 on-call rosterto ensure continuous incident response readiness.\n\nAI & Cloud Security Response\nDevelop and execute response procedures for AI-enabled applications, large language model (LLM) workflows, AI gateways, and API data paths.\n\nImplement automated triage, observability tooling, and detection rules to rapidly identify and isolate novel threats.\n\nCross-Functional Crisis Coordination\nCollaborate with Product Engineering, SRE, Legal, Privacy, Communications, and Support teams during active investigations.\n\nAuthor actionable post-incident reports, executive briefings, and customer notification materials.\n\nOperational Resilience & Continuous Improvement\nFacilitate post-incident reviews (PIRs/RCAs) to identify systemic risks and drive preventative engineering fixes.\n\nConduct tabletop exercises, purple team simulations, and playbook updates to continuously improveMTTDandMTTR.\n\nQualifications & Requirements\nCitizenship & Compliance (Mandatory)\nMust be a U.S. Citizen(required to support F5’s FedRAMP authorization, federal compliance mandates, and regulated environments).\n\nExperience & Availability\n5+ yearsof hands-on experience in Incident Response, Security Operations (SOC), Threat Hunting, or Digital Forensics in enterprise cloud/SaaS environments.\n\nWillingness and ability to participate in arotating 24/7 on-call schedule.\n\nTechnical Skills\nDeep familiarity with application security, reverse proxies, load balancers, WAF/WAAP, API gateways, DDoS mitigation, and Kubernetes ingress security.\n\nStrong experience analyzing telemetry across AWS/Azure/GCP, SIEM/EDR platforms (e.g., CrowdStrike), identity systems, and network logs.\n\nWorking knowledge of modern attack techniques (MITRE ATT&CK), API vulnerabilities, and emerging AI/LLM security risks.\n\nFrameworks\nSolid understanding of incident response frameworks and standards (NIST SP 800-61, ISO 27001, SOC 2, FedRAMP, PCI-DSS).\n\nSuccess Measures (First 12-18 Months)\nSuccessfully lead incident response investigations while meeting target response SLAs.\n\nExpand playbook coverage and automated response actions for hybrid cloud and AI/API services.\n\nMeasurably reduce MTTC/MTTR through automated triage and streamlined escalation paths.\n\nIntegrate smoothly into the on-call rotation and support FedRAMP readiness initiatives.\n\nThe Job Description is intended to be a general representation of the responsibilities and requirements of the job. However, the description may not be all-inclusive, and responsibilities and requirements are subject to change.\nThe annual base pay for this position is: $132,000.00 - $198,000.00F5 maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience, geographic locations, and market conditions, as well as to reflect F5’s differing products, industries, and lines of business. The pay range referenced is as of the time of the job posting and is subject to change.\nYou may also be offered incentive compensation, bonus, restricted stock units, and benefits. More details about F5’s benefits can be found at the following link: https://www.f5.com/company/careers/benefits. F5 reserves the right to change or terminate any benefit plan without notice.\nPlease note that F5 only contacts candidates through F5 email address (ending with @f5.com) or auto email notification from Workday (ending with f5.com ).\nEqual Employment Opportunity\nIt is the policy of F5 to provide equal employment opportunities to all employees and employment applicants without regard to unlawful considerations of race, religion, color, national origin, sex, sexual orientation, gender identity or expression, age, sensory, physical, or mental disability, marital status, veteran or military status, genetic information, or any other classification protected by applicable local, state, or federal laws. This policy applies to all aspects of employment, including, but not limited to, hiring, job assignment, compensation, promotion, benefits, training, discipline, and termination. F5 offers a variety of reasonable accommodations for candidates. Requesting an accommodation is completely voluntary. F5 will assess the need for accommodations in the application process separately from those that may be needed to perform the job. Request by contacting .","description_format":"text","description_chars":6098,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Restricted stock units"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Network Security","Application Security","Web Security & DDoS Protection"],"lifecycle":[{"event":"open","at":"2026-08-19T00:00:00Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"green card filings: 1","filings_12m":0,"filings_prev_12m":4,"green_card_filings_12m":1,"median_offered_wage_usd":197500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":21,"band":"cold","label":"Long shot","p_open":1,"p_active":0.483,"p_room":0.44,"age_days":59,"expected_fill_days":43,"reasons":["conf:1","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":198000,"is_top_pay":true},"html_url":"https://alion.io/job/f5-security-engineer-incident-response","json_url":"https://alion.io/job/f5-security-engineer-incident-response.json","meta":{"generated_at":"2026-10-17T14:00:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":18834,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5759},"rest":"https://alion.io/mcp/rest/get_company?id=5759"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ff5-security-engineer-incident-response"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ff5-security-engineer-incident-response"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ff5-security-engineer-incident-response"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/f5-security-engineer-incident-response\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ff5-security-engineer-incident-response"}]}