{"id":2196442,"url":"https://alion.io/job/harvey-incident-handler-2","title":"Incident Handler","company":{"id":2669,"name":"Harvey","domain":"harvey.ai","url":"https://alion.io/company/harvey","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":80,"open_postings":93,"ghost_share":0,"stale_share":0.806,"repost_share":0.022,"time_to_fill_p50_days":40,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Legal","role_family":"Legal","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Francisco, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":133600,"max":200400,"currency":"USD","period":"year","gross":null,"usd_annual":200400},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"Threat Modeling","optional":false}],"status":"live","first_seen_at":"2026-10-09T16:44:38Z","employer_posted_date":"2026-10-09","last_verified_at":"2026-10-18T07:13:31Z","board_verified":true,"closed_at":null,"days_open":8,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":8},"description":"Why Harvey\nAt Harvey, we’re transforming how legal and professional services operate. By combining frontier agentic AI, an enterprise-grade platform, and deep domain expertise, we’re reshaping how critical knowledge work gets done for decades to come.\nThis is a rare chance to help build a generational company at a true inflection point. We have strong product-market fit and world-class investor support. We’re scaling fast and defining a new category in real time. The work is ambitious, the bar is high, and the opportunity for growth - personal, professional, and financial - is unmatched.\nOur team moves fast, takes ownership, and is deeply committed to the mission - operating with intensity, staying close to our customers, and pushing each other for excellence. We live by three values: Decisiveness, Simplicity, and Job's Not Finished. We act quickly on clear judgment over perfect information, we believe simplicity is what scales, and we're never satisfied with where we are. If you want to do the best work of your career alongside people who share that drive, we'd love to build with you.\nAt Harvey, the future of professional services is being written today - and we’re just getting started.\nRole Overview\nHarvey’s products sit at the intersection of frontier AI, sensitive customer data, and critical business workflows. Our customers trust us to protect their information in an always-accelerating threat ecosystem, and security is how we foremost earn and keep our customers’ trust. We’re hiring an experienced Incident Response Handler to drive and ultimately lead incident response for security events. You will command incidents, coordinate containment, and enforce that real fixes are implemented, preventing recurrence. You’ll join a small, highly technical security team early in standing up a dedicated Detection & Response function, with real latitude to define how Harvey does incident response for years to come. Like the rest of Harvey’s security team, our program is built on offensive security experience - most engineers come from red-team, pentesting, or incident-response backgrounds, and we bring an attacker’s mindset to detection and response. This is an individual contributor role for someone who has operated in mature security organizations at leading technology companies and wants to help define incident response at one of the most important AI companies in the world.\nWhat You'll Do\nBuild strong relationships with key employees across the organization\n\nParticipate in security incidents, leading investigations across cloud infrastructure, identity systems, corporate environments, and our AI platforms.\n\nUse, maintain, and contribute to an internally developed agentic SOC, fine tuned to Harvey’s threat environment\n\nWork cross functionally across technical and operational orgs, ensuring the right PRs ship and best policies are enforced\n\nContribute to Harvey’s Detection & Response roadmap, including metrics, SLAs, threat modeling, and tabletop exercises for our most critical business risks.\n\nWork across teams to ensure incident follow ups are meaningfully closed\n\nMentor engineers and incident responders, build playbooks and operational standards, and raise the security bar across the company.\n\n What You Have\n3+ years of experience in Incident Response, Detection & Response, Security Operations, Threat Detection, or related security engineering disciplines.\n\nExperience participating in investigations and response efforts for complex security incidents in cloud-native environments.\n\nDeep understanding of attacker tactics, techniques, and procedures (MITRE ATT&CK and modern threat actor tradecraft).\n\nExperience with one or more major cloud platforms (AWS, GCP, Azure), plus strong knowledge of operating systems, networking, and identity systems.\n\nExperience building security automation and tooling, with strong scripting or software engineering skills in Python, Go, or similar languages.\n\nExperience communicating incident status and risk to senior leadership.\n\n Compensation\n$133,600 - $200,400 USD\nDepending on your location, an Applicant Privacy Notice may apply to you. You can find all of our Applicant Privacy Noticeshere.\nHarvey is an equal opportunity employer and does not discriminate on the basis of race, gender, sexual orientation, gender identity/expression, national origin, disability, age, genetic information, veteran status, marital status, pregnancy or related condition, or any other basis protected by law.\nWe are committed to providing reasonable accommodations to applicants with disabilities, and requests can be made by emailing ","description_format":"text","description_chars":4644,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["LLM & Generative AI","Document AI","Legal AI"],"lifecycle":[{"event":"open","at":"2026-10-09T19:40:15Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 1","filings_12m":1,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":162500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)"],"filings_for_role_12m":0}],"liveness":{"score":62,"band":"ok","label":"Likely open","p_open":1,"p_active":0.624,"p_room":1,"age_days":7,"expected_fill_days":40,"reasons":["conf:0","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":200400,"is_top_pay":true},"html_url":"https://alion.io/job/harvey-incident-handler-2","json_url":"https://alion.io/job/harvey-incident-handler-2.json","meta":{"generated_at":"2026-10-18T10:29:41Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15516,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2669},"rest":"https://alion.io/mcp/rest/get_company?id=2669"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fharvey-incident-handler-2"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fharvey-incident-handler-2"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fharvey-incident-handler-2"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/harvey-incident-handler-2\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fharvey-incident-handler-2"}]}