The ad says“Certifications such as GCIA, GCIH, GCFA, OSCP, or similar”
The ad says“Certifications such as GCIA, GCIH, GCFA, OSCP, or similar”
The ad says“Certifications such as GCIA, GCIH, GCFA, OSCP, or similar”
The ad says“Certifications such as GCIA, GCIH, GCFA, OSCP, or similar”
The ad says“Working knowledge of cloud security operations (AWS, GCP, or Azure) and the unique telemetry, attack patterns, and response considerations of cloud-native environments”
The ad says“Working knowledge of cloud security operations (AWS, GCP, or Azure) and the unique telemetry, attack patterns, and response considerations of cloud-native environments”
The ad says“Working knowledge of cloud security operations (AWS, GCP, or Azure) and the unique telemetry, attack patterns, and response considerations of cloud-native environments”
The ad says“Hands-on experience with EDR platforms (CrowdStrike strongly preferred; SentinelOne, Defender, or similar also relevant) including detection engineering and tuning”
The ad says“Experience with SIEM detection engineering at scale (CrowdStrike Falcon LogScale/NG-SIEM, Splunk, Sumo Logic, Panther, or similar)”
The ad says“Strong detection engineering background: you’ve written, tested, and maintained detection content at scale and understand the tradeoffs between coverage, fidelity, and analyst load”
The ad says“Hands-on experience with EDR platforms (CrowdStrike strongly preferred; SentinelOne, Defender, or similar also relevant) including detection engineering and tuning”
The ad says“Working knowledge of cloud security operations (AWS, GCP, or Azure) and the unique telemetry, attack patterns, and response considerations of cloud-native environments”
The ad says“Experience with Incident.io, PagerDuty, or comparable incident management tooling”
The ad says“Experience with Incident.io, PagerDuty, or comparable incident management tooling”
The ad says“Experience with SIEM detection engineering at scale (CrowdStrike Falcon LogScale/NG-SIEM, Splunk, Sumo Logic, Panther, or similar)”
The ad says“Strong scripting and automation skills (Python, SOAR platforms) applied to detection, response, and reporting workflows”
The ad says“Experience with SIEM detection engineering at scale (CrowdStrike Falcon LogScale/NG-SIEM, Splunk, Sumo Logic, Panther, or similar)”
The ad says“Strong scripting and automation skills (Python, SOAR platforms) applied to detection, response, and reporting workflows”
The ad says“Experience with SIEM detection engineering at scale (CrowdStrike Falcon LogScale/NG-SIEM, Splunk, Sumo Logic, Panther, or similar)”
The ad says“Experience with SIEM detection engineering at scale (CrowdStrike Falcon LogScale/NG-SIEM, Splunk, Sumo Logic, Panther, or similar)”
The ad says“Threat intelligence experience, including operationalizing intel into detection and hardening outcomes”
We’re hiring our first Security Operations Lead to build and run the SecOps function at Fireworks AI
As we scale our AI infrastructure platform globally, we’re investing in a modern detection and response capability anchored on CrowdStrike (EDR and SIEM, 365-day retention), Console AI for ticketing, and Incident
Io for on-call and incident management
We have a Security Incident Response Plan (SIRP) in place that you’ll build on, and you’ll own the function end-to-end: standing up detection content, operationalizing our incident response playbooks, running threat intel into action, and building the operational muscle that keeps Fireworks resilient as we grow
This role sits within the Security team and will primarily support Corporate Security and own incident response broadly, while partnering closely with Security Engineering on infrastructure-related incidents — bridging both areas
This is an IC-to-manager role: you’ll start hands-on building and running the function, growing into a people leader as the team scales
Lead the rollout, tuning, and ongoing operation of CrowdStrike across our endpoint and cloud environment and SIEM use cases, partnering with IT and Security Engineering on deployment and coverage
Define and operate our detection and response program: build detection content, establish triage and escalation workflows, and continuously measure and improve coverage against frameworks like MITRE ATT&CK
Own incident response end-to-end: operationalize our existing SIRP into detailed playbooks, run incidents, lead post-incident reviews, and drive lessons learned into program improvements
Stand up our security operations workflow, including SOAR automation with Incident.io for alerting, on-call, and incident orchestration, while also defining how incidents self-submitted through our IT ticketing system are triaged and handled as one-off cases — along with the SLAs and metrics the function runs on
Build and operationalize a threat intelligence capability: track threats relevant to AI infrastructure and our customer base, and translate intel into detections, hardening, and tabletop scenarios
Partner closely with Infrastructure, Corporate Security, and other cross-functional teams across the organization, engaging as needed to support incidents and shared initiatives
As the function matures, you’ll have the opportunity to:
Hire and build the SecOps team, growing from IC to people leader
Expand 24x7 coverage and adjacent capabilities like cloud detection engineering, insider threat, or red team / purple team operations
Shape the broader security strategy as a senior leader in the function
Preferred experience
Strong detection engineering background: you’ve written, tested, and maintained detection content at scale and understand the tradeoffs between coverage, fidelity, and analyst load
Strong scripting and automation skills (Python, SOAR platforms) applied to detection, response, and reporting workflows
Experience building or significantly maturing a SecOps function, including tooling selection, process design, and metrics
7+ years in security operations, detection and response, incident response, or a closely related field
Hands-on experience with EDR platforms (CrowdStrike strongly preferred; SentinelOne, Defender, or similar also relevant) including detection engineering and tuning
Comfort operating in a build phase: you can write the playbook and run the playbook, and you know when to invest in process versus when to just get things done
Demonstrated incident response leadership: you’ve run real incidents from triage through executive communication and post-incident review
Working knowledge of cloud security operations (AWS, GCP, or Azure) and the unique telemetry, attack patterns, and response considerations of cloud-native environments
Certifications such as GCIA, GCIH, GCFA, OSCP, or similar
Prior experience at an AI, cloud infrastructure, or high-growth SaaS company
Threat intelligence experience, including operationalizing intel into detection and hardening outcomes
Experience with Incident.io, PagerDuty, or comparable incident management tooling
Experience with SIEM detection engineering at scale (CrowdStrike Falcon LogScale/NG-SIEM, Splunk, Sumo Logic, Panther, or similar)
