Senior Security Engineer, Incident Response

At 1Password, security isn’t just a feature – it’s our foundation. The Security Operations team’s mission is to protect the business by securing the systems, tools, and processes that power how we work. Our mission is to keep 1Password productive, resilient, and safe through proactive monitoring, rapid response, and continuous improvement of preventative and detective controls.

As a Senior Security Engineer on the Incident Response team, you will lead complex security investigations while also building the systems and automation that make response faster, more reliable, and more scalable.

This role blends deep investigative expertise, hands-on engineering, and structured incident coordination. You will drive incidents end-to-end, build automation and workflows that reduce response friction, and contribute to a culture of learning and psychological safety during high-pressure situations.

This is a high-impact role with meaningful ownership across both incident execution and operational engineering.

This role reports to the Manager of Security Incident Response.

- An experienced incident lead who can independently drive complex investigations and coordinate diverse stakeholders.

- A builder who enjoys improving systems, automation, and workflows – not just responding to alerts.

- Calm and decisive under pressure, with strong judgment in ambiguous or high-severity situations.

- Structured and organized, with strong project management skills to own complex projects

- A clear communicator who can translate technical findings into actionable guidance for both technical and non-technical audiences.

- A collaborative teammate who values blameless learning and psychological safety

- 5+ years of experience in security incident response roles, with 3+ years focused on security engineering and automation.

- Proven experience leading complex security incidents in cloud-native or SaaS environments.

- Experience building automation or internal tooling to improve security operations.

- Proficiency in scripting or programming (e.g., Python, Go, Bash) and working with APIs or orchestration platforms.

- Familiarity with applying AI/ML-assisted workflows to operational security use cases.

- Strong understanding of modern attacker techniques and incident response methodologies.

- Strong written and verbal communication skills, including executive-facing summaries.

- Lead and execute security incidents end-to-end, from initial signal through containment, recovery, and post-incident review

- Assess severity, declare incidents, and drive structured coordination and decision-making during active response

- Perform hands-on investigations and threat hunting to determine root cause, attacker behavior, scope, and impact

- Design and build automation to reduce triage, investigation, and response time

- Develop scalable systems and workflows that improve incident response and incident management

- Identify recurring pain points and detection/response gaps, and implement durable engineering solutions

- Improve incident response playbooks, case management, and orchestration tooling

- Apply AI-assisted tooling to enhance triage, enrichment, and investigative workflows while maintaining accuracy

USA-based roles only: The annual base salary for this role is between $153,000 USD and $214,000 USD plus immediate participation in 1Password's benefits program (health, dental, 401k and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs.

Canada-based roles only: The annual base salary for this role is between $144,000 CAD and $202,000 CAD plus immediate participation in 1Password’s generous benefits program (health, dental, RRSP and many others), utilization of our generous paid time off, an equity grant and, where applicable, participation in our incentive programs.

At 1Password, we prioritize collaboration, clear and transparent communication, receptiveness to feedback, and alignment with our core values: keep it simple, lead with honesty, and put people first.

You’ll be part of a team that challenges the status quo, and is excited to experiment and iterate in search of the best solution. That said, 1Password is not for everyone. Our work is demanding, we strive for excellence, and the pace is fast.

We need people who are keen to take on challenging problems, who seek feedback to grow, and who are driven to make an impact. If you're looking for a place where you can settle into a comfortable routine, this might not be the right fit for you. We’re looking for individuals who are proven experts in their fields, as well as those who are highly adaptable, can thrive in ambiguity and through change, are curious, and above all deliver results.

We are committed to leveraging cutting-edge technology—including AI—to achieve our mission. We also understand that thinking critically about AI in its current forms will help us create better solutions for our customers and ourselves with its future forms, which will help us continue to close the gap between security and privacy and achieve our mission.

We want team members at all levels to take the approach of actively learning AI best practices, identifying opportunities to apply AI in meaningful ways, and driving innovative solutions in their daily work. Embracing the future of AI isn't just encouraged at 1Password—it's an essential part of how we will be successful at 1Password.

We believe in the power of remote work, but recognize that in-person connection is important to help us achieve our mission. While we are a remote-first company, travel for in-person engagement is a part of almost all roles, and we require our employees to be ready and willing to take part. Frequency will depend on role and responsibilities, and may include, but is not limited to: annual department-wide offsites, team meetings, and customer/industry events.

We believe in working hard, and rewarding that hard work through our benefits. While not an exhaustive list, here is a glance at what we currently offer: