← All roles

Senior Security Engineer, Detection & Response

Block· 10404 Engineering - Information Security
Apply on company site
Hybrid (Bay Area)$196.1k - $326.8kFull-timePosted 2w ago

About the role

Senior Security Engineer for Block's Detection and Response Team (DART), focusing on CSIRT-led investigations, incident containment, remediation, and process/tooling improvements.

Responsibilities

  • Command complex, high-impact security incidents from initial assessment through containment, recovery, and closure.
  • Investigate threats across endpoint, identity, cloud, SaaS, network, and application systems and drive containment and remediation with system owners, weighing urgency, evidence preservation, and business impact.
  • Reconstruct timelines, preserve evidence, and determine the scope and impact of incidents.
  • Coordinate containment and remediation with system owners while balancing urgency and business impact.
  • Keep incident priorities, decisions, owners, and handoffs clear across teams and time zones.
  • Lead post-incident reviews and drive findings, uncertainty, and response decisions to technical teams and business partners.
  • Write code, queries, and automation that accelerate evidence collection, analysis, and response. Partner with triage, detection, threat intelligence, and infrastructure teams to address missing telemetry, improve detections, and remove recurring manual work.
  • Mentor responders and participate in the incident response on-call rotation.

Qualifications

  • 6+ years of hands-on incident response and digital forensics experience.
  • Experience commanding major security incidents involving multiple teams and competing priorities.
  • Strong knowledge of attacker behavior and depth in several areas of identity, endpoint, cloud, network, or application security.
  • Strong SQL/database understanding and log-analysis skills, and practical programming or scripting ability, such as Python. Ability to analyze large, messy datasets and build reliable tools that improve investigations and response, both with and without AI.
  • An established AI-assisted workflow and actively develop AI-based systems and processes that improve incident coordination and case management.
  • Clear communication and sound judgment when working with technical teams, executives, and sensitive information.
  • Engineering mindset and track record of turning incident response lessons into lasting improvements.
  • A need to build: developing systems and workflows that improve incident response and connect with broader investigation, automation, and case management capabilities.

Skills

Required:Incident response and digital forensicsThreat hunting / threat analysisSQL / database queryingProgramming / scripting (Python)

Benefits

  • Remote work
  • medical insurance
  • flexible time off
  • retirement savings plans
  • modern family planning
Last updated Oct 14, 2026. Interested? Apply on the company site.
Block logo

About Block

Block builds technology to increase access to the global economy.

Made up of Square, Cash App, Afterpay, TIDAL, Bitkey, and Proto, Block, Inc. builds technology to increase access to the global economy.

technologyfinancial servicesdigital paymentsmusic streaming
Company profileWebsite

More open roles at Block