Lead end-to-end response for high-severity cyber and product security incidents (detection, containment, eradication, and recovery).
Drive incident command workflows, track mitigation workstreams, document forensic findings, and deliver clear technical updates to stakeholders.
On-Call Availability: Participate in a scheduled, rotating 24/7 on-call roster to ensure continuous incident response readiness.
AI & Cloud Security Response
Develop and execute response procedures for AI-enabled applications, large language model (LLM) workflows, AI gateways, and API data paths.
Implement automated triage, observability tooling, and detection rules to rapidly identify and isolate novel threats.
Cross-Functional Crisis Coordination
Collaborate with Product Engineering, SRE, Legal, Privacy, Communications, and Support teams during active investigations.
Author actionable post-incident reports, executive briefings, and customer notification materials.
Operational Resilience & Continuous Improvement
Facilitate post-incident reviews (PIRs/RCAs) to identify systemic risks and drive preventative engineering fixes.
Conduct tabletop exercises, purple team simulations, and playbook updates to continuously improve MTTD and MTTR.
Qualifications & Requirements
Citizenship & Compliance (Mandatory)
Must be a U.S. Citizen (required to support F5’s FedRAMP authorization, federal compliance mandates, and regulated environments).
Experience & Availability
5+ years of hands-on experience in Incident Response, Security Operations (SOC), Threat Hunting, or Digital Forensics in enterprise cloud/SaaS environments.
Willingness and ability to participate in a rotating 24/7 on-call schedule.
Technical Skills
Deep familiarity with application security, reverse proxies, load balancers, WAF/WAAP, API gateways, DDoS mitigation, and Kubernetes ingress security.
Strong experience analyzing telemetry across AWS/Azure/GCP, SIEM/EDR platforms (e.g., CrowdStrike), identity systems, and network logs.
Working knowledge of modern attack techniques (MITRE ATT&CK), API vulnerabilities, and emerging AI/LLM security risks.
Frameworks
Solid understanding of incident response frameworks and standards (NIST SP 800-61, ISO 27001, SOC 2, FedRAMP, PCI-DSS).
Success Measures (First 12–18 Months)
Successfully lead incident response investigations while meeting target response SLAs.
Expand playbook coverage and automated response actions for hybrid cloud and AI/API services.
Measurably reduce MTTC/MTTR through automated triage and streamlined escalation paths.
Integrate smoothly into the on-call rotation and support FedRAMP readiness initiatives.
#LI-KA1
The Job Description is intended to be a general representation of the responsibilities and requirements of the job. However, the description may not be all-inclusive, and responsibilities and requirements are subject to change.
The annual base pay for this position is: $132,000.00 - $198,000.00
F5 maintains broad salary ranges for its roles in order to account for variations in knowledge, skills, experience, geographic locations, and market conditions, as well as to reflect F5’s differing products, industries, and lines of business. The pay range referenced is as of the time of the job posting and is subject to change.
You may also be offered incentive compensation, bonus, restricted stock units, and benefits. More details about F5’s benefits can be found at the following link: https://www.f5.com/company/careers/benefits. F5 reserves the right to change or terminate any benefit plan without notice.
Please note that F5 only contacts candidates through F5 email address (ending with @f5.com) or auto email notification from Workday (ending with f5.com or @myworkday.com).
Equal Employment Opportunity
It is the policy of F5 to provide equal employment opportunities to all employees and employment applicants without regard to unlawful considerations of race, religion, color, national origin, sex, sexual orientation, gender identity or expression, age, sensory, physical, or mental disability, marital status, veteran or military status, genetic information, or any other classification protected by applicable local, state, or federal laws. This policy applies to all aspects of employment, including, but not limited to, hiring, job assignment, compensation, promotion, benefits, training, discipline, and termination. F5 offers a variety of reasonable accommodations for candidates. Requesting an accommodation is completely voluntary. F5 will assess the need for accommodations in the application process separately from those that may be needed to perform the job. Request by contacting accommodations@f5.com.
