Partner 34, Lead Engineer, Incident Response
Hands-on lead engineer who heads a16z's security detection and incident response team: investigating incidents, writing and tuning detections as code, building AI-assisted automation, and leading major incident response across the firm's cloud, SaaS, identity, and endpoint environments, while also managing the team's engineers. Core tech: SIEM, KQL/Sigma, EDR, SOAR, Python, AWS/GCP.
- Compensation
- $295K–$347K / yr
- Location
- San Francisco, California, United States
- Work setup
- Not specified
- Seniority
- Lead
- Employment
- Not specified
- Experience
- 9+ years
- Category
- Security
- Posted
Skills
Must have
- 9+ years of incident response or detection and response experience with depth in cloud incident response across AWS and GCP
- Prior experience managing security engineers, including coaching and performance management, while remaining technically hands-on
- Track record of building and leading detection and response programs, making architecture and prioritization decisions, and delivering measurable improvements
- Experience leading high-stakes incidents across cloud, SaaS, identity, and endpoint environments, including forensic investigation, containment, recovery, and postmortems
- Strong detection engineering skills, including SIEM query languages or rule formats such as KQL or Sigma, detection-as-code, testing, and tuning
- Experience designing SIEM and security log pipelines and using cloud logs, EDR, and SOAR tools in investigations and response
- Experience running hypothesis-driven threat hunts and investigating sophisticated attacks, including identity compromise, social engineering, and data exfiltration
- Strong Python skills and experience building and reviewing maintainable security automation
- Working knowledge of AI and agent systems, including their limitations and security risks in triage and response workflows
- Experience leading cross-functional security work and communicating incident impact, uncertainty, and trade-offs to non-technical stakeholders and senior leaders
- Sound judgment under pressure, balancing security risk and business impact and knowing when to escalate
- Low ego, high empathy, and a track record of effective collaboration across teams
- Ability to be in the San Francisco office 2 days a week
Nice to have
- GCIH or an equivalent incident response certification
Full description
Founded in Silicon Valley in 2009 by Marc Andreessen and Ben Horowitz, Andreessen Horowitz (aka a16z) is a venture capital firm that backs bold entrepreneurs building the future through technology. We are stage agnostic. We invest in seed to venture to growth-stage technology companies, across AI, bio + healthcare, consumer, enterprise, fintech, frontier, games, and companies building toward American dynamism. a16z has $100B+ under management across multiple funds.
We’ve established a team that is defined by respect for the entrepreneur and the company-building process; we know what it’s like to be in the founder’s shoes. We’ve invested in companies like Anduril, Airbnb, Coinbase, Cursor, Databricks, Deel, Figma, GitHub, Roblox, SpaceX, and Stripe. Our team is at the forefront of new technology, helping founders and their companies impact and change the world.
The Role
We're hiring a Lead Engineer, Incident Response to lead and shape a16z's detection and response team. This is a hands-on role: you'll spend a significant portion of your time investigating incidents, writing and reviewing detections, building automation, and making the harder technical response decisions. You'll also manage and develop the engineers on the team.
You'll build and improve detection and response capabilities across the firm's cloud, SaaS, identity, and endpoint environments, shaping the roadmap, tooling, threat hunting, and response practices. You'll also develop capabilities to protect the firm against impersonation and fraud. You'll work closely with Security Engineering, IT, Legal, Compliance, and other cross-functional teams to put these capabilities into practice and turn lessons from incidents into better detections, tooling, and controls.
Venture capital firms face threats that extend beyond their infrastructure: capital call wire fraud, impersonation, and social engineering against employees and partners, alongside attacks by organized criminal and nation-state groups. Your work protects sensitive firm and limited partner (LP) information, financial transactions, and the relationships the firm depends on.
This role requires an in-office presence 2 days a week in our San Francisco, CA office.
To join our team, you should be excited to:
- Set the detection and response roadmap, prioritizing the threats that matter most to the firm and measuring detection coverage, alert quality, and response effectiveness
- Lead and develop engineers through coaching, feedback, performance management, and technical reviews, working alongside them on investigations and engineering projects
- Develop the team's ability to respond from triage through containment, eradication, and recovery, including vendor incidents. Lead major incidents, coordinate a16z's technical response with system owners and affected providers, and escalate decisions requiring leadership or Legal approval