Security Response Engineer, Incident Response

Tags: Web3 Jobs • Web3 Full Time Jobs • Cryptocurrency Remote Jobs • Cryptocurrency Developer Jobs • Web3 Security Jobs • Blockchain Rust Jobs

About ChainlinkChainlink is the industry-standard oracle platform bringing the capital markets onchain and powering the majority of decentralized finance (DeFi). The Chainlink stack provides the essential data, interoperability, compliance, and privacy standards needed to power advanced blockchain use cases for institutional tokenized assets, lending, payments, stablecoins, and more. Since inventing decentralized oracle networks, Chainlink has enabled tens of trillions in transaction value and now secures the vast majority of DeFi.

Many of the world’s largest financial services institutions have also adopted Chainlink’s standards and infrastructure, including Swift, Euroclear, Mastercard, Fidelity International, UBS, S&P Dow Jones Indices, FTSE Russell, WisdomTree, ANZ, and top protocols such as Aave, Lido, GMX and many others. Chainlink leverages a novel fee model where offchain and onchain revenue from enterprise adoption is converted to LINK tokens and stored in a strategic Chainlink Reserve. Learn more at chain.link.

About The Role

As a Security Response Engineer, you’ll own the full security incident response lifecycle. You’ll serve as incident commander – owning the high-level coordination of incidents from scoping through to recovery and post-mortem improvements. We’re looking for a seasoned individual contributor who is comfortable operating across diverse environments. In addition to response efforts, you’ll be heavily involved with the team’s operational responsibilities (creating and refining detections, playbooks, and processes) and project work (automating response actions, improving visibility through creation and deployment of new tooling). You would help continuously improve our response capabilities and efficiency by collaborating with internal and external stakeholders across the company.

Your Impact

• Own and improve the incident response lifecycle: act as incident commander for high-severity incidents

• Join the team's on-call rotation: triage inbound alerts/escalations, coordinate internal and company-wide incidents

• Improve response readiness: create and automate playbooks, conduct tabletop exercises

• Address security telemetry gaps: improve existing or build/deploy new tools

• Increase detection quality: write and tune high-signal detections (in Sigma)

• Proactively identify and implement areas of improvement and modernization

Requirements

• Proven incident response leadership: experience as the primary incident commander for high‑severity security incidents involving multiple teams and external stakeholders, and can independently manage incident timelines, decisions, and communications

• Operational rigor and investigation depth: demonstrated experience with triage, scoping, containment, and remediation across endpoint, cloud, and/or network based incidents; drives root‑cause analysis and post‑incident action items to completion.…