Security Engineer - Incident Response

This is a hands-on, execution-focused role. It's ideal for a practitioner who thrives in high-tempo environments and is comfortable owning end-to-end incident lifecycle responsibilities. Key Responsibilities Incident Command & Triage

• Serve as Incident Commander for SIRN-related security cases, owning coordination from detection through resolution and post-incident review.

• Lead incident triage efforts, rapidly assessing scope, severity, and impact to drive prioritization and response decisions.

• Coordinate with internal AR teams and external Solana ecosystem stakeholders throughout active incident lifecycles.

• On-call availability

Telemetry & Detection

• Develop, tune, and triage telemetry signals relevant to SIRN use cases, including on-chain event monitoring and infrastructure-level detection.

• Identify gaps in current detection coverage and propose improvements to signal fidelity and alert quality.

Runbook Curation

• Author, maintain, and continuously improve incident runbooks tailored to SIRN scenarios.

• Ensure runbooks reflect current threat landscape, ecosystem-specific attack patterns, and lessons learned from prior incidents.

Project & Logistics Support

• Provide operational and logistical support to the SIRN project team, including tracking deliverables, coordinating stakeholder communications, and ensuring project milestones are met.

• Escalate to AR Engineering and Consulting leads as appropriate.

• Maintain clear documentation across all assigned workstreams.

Qualifications Required

• 3+ years of security engineering or incident response experience, with demonstrated depth in operational IR roles.

• Experience with Web3 security, blockchain incident response, or protocol-level threat analysis (Solana ecosystem experience a strong plus).

• Strong communication skills - able to convey technical findings clearly to both engineering teams and non-technical stakeholders under pressure.

• Ability to work independently and with high autonomy in a fully remote setting.

• Background in Web2 security operations (EDR, MDM, Google Workspace, or equivalent platforms).

• Familiarity with DeFi attack patterns, smart contract exploits, or on-chain forensics.

Preferred

• Bachelor's or Master's degree in Computer Science, Information Security, or a related field (or equivalent practical experience).

• Proven experience as an Incident Commander or equivalent lead role in complex, fast-moving security events.

• Hands-on experience developing or tuning telemetry, detection pipelines, or monitoring systems (SIEM, on-chain alerting, or equivalent).