a16z · San Francisco, California, United States · San Francisco, California, United States
<p><span style="font-family: 'times new roman', times, serif;">Founded in Silicon Valley in 2009 by Marc Andreessen and Ben Horowitz, Andreessen Horowitz (aka a16z) is a venture capital firm that backs bold entrepreneurs <a href="https://a16z.com/news-content">building the future</a> through technology. We are <a href="https://a16z.com/portfolio">stage agnostic</a>. We invest in seed to venture to <a href="https://a16z.com/growth/">growth-stage technology</a> companies, across <a href="https://a16z.com/ai/">AI</a>, <a href="https://a16z.com/bio-health/">bio + healthcare</a>, <a href="https://a16z.com/consumer/">consumer</a>, <a href="https://a16z.com/enterprise/">enterprise</a>, <a href="https://a16z.com/fintech/">fintech</a>, <a href="https://a16zfrontier.com/">frontier</a>, <a href="https://a16z.com/games">games</a>, and companies building toward <a href="https://a16z.com/american-dynamism/">American dynamism</a>. a16z has $100B+ under management across multiple funds.</span></p> <p><span style="font-family: 'times new roman', times, serif;">We’ve established a team that <a href="https://a16z.com/about/">is defined by</a> respect for the entrepreneur and the company-building process; we know what it’s like to be in the founder’s shoes. We’ve invested in <a href="https://a16z.com/portfolio/">companies</a> like Anduril, Airbnb, Coinbase, Cursor, Databricks, Deel, Figma, GitHub, Roblox, SpaceX, and Stripe. Our team is at the forefront of new technology, helping founders and their companies impact and change the world.</span></p> <h2><span style="font-family: 'times new roman', times, serif;">The Role</span></h2> <p><span style="font-family: 'times new roman', times, serif;">We're hiring a Lead Engineer, Incident Response to lead and shape a16z's detection and response team. This is a hands-on role: you'll spend a significant portion of your time investigating incidents, writing and reviewing detections, building automation, and making the harder technical response decisions. You'll also manage and develop the engineers on the team.</span></p> <p><span style="font-family: 'times new roman', times, serif;">You'll build and improve detection and response capabilities across the firm's cloud, SaaS, identity, and endpoint environments, shaping the roadmap, tooling, threat hunting, and response practices. You'll also develop capabilities to protect the firm against impersonation and fraud. You'll work closely with Security Engineering, IT, Legal, Compliance, and other cross-functional teams to put these capabilities into practice and turn lessons from incidents into better detections, tooling, and controls.</span></p> <p><span style="font-family: 'times new roman', times, serif;">Venture capital firms face threats that extend beyond their infrastructure: capital call wire fraud, impersonation, and social engineering against employees and partners, alongside attacks by organized criminal and nation-state groups. Your work protects sensitive firm and limited partner (LP) information, financial transactions, and the relationships the firm depends on.</span></p> <p><span style="font-family: 'times new roman', times, serif;">This role requires an in-office presence 2 days a week in our San Francisco, CA office.</span></p> <h2><span style="font-family: 'times new roman', times, serif;">To join our team, you should be excited to: </span></h2> <ul> <li style="font-family: 'times new roman', times, serif;"><span style="font-family: 'times new roman', times, serif;">Set the detection and response roadmap, prioritizing the threats that matter most to the firm and measuring detection coverage, alert quality, and response effectiveness</span></li> <li style="font-family: 'times new roman', times, serif;"><span style="font-family: 'times new roman', times, serif;">Lead and develop engineers through coaching, feedback, performance management, and technical reviews, working alongside them on investigations and engineering projects</span></li> <li style="font-family: 'times new roman', times, serif;"><span style="font-family: 'times new roman', times, serif;">Develop the team's ability to respond from triage through containment, eradication, and recovery, including vendor incidents. Lead major incidents, coordinate a16z's technical response with system owners and affected providers, and escalate decisions requiring leadership or Legal approval</span></li> <li style="font-family: 'times new roman', times, serif;"><span style="font-family: 'times new roman', times, serif;">Maintain and test response playbooks and escalation criteria through cross-functional tabletop exercises and incident simulations</span></li> <li style="font-family: 'times new roman', times, serif;"><span style="font-family: 'times new roman', times, serif;">Design and improve SIEM architecture and security logging with Security Engineering and IT, expanding detection coverage across cloud, identity, and endpoint environments, including EDR. Write, review, test, and tune detections as code, using relevant MITRE ATT&CK techniques to assess coverage and working with system owners to close visibility gaps</span></li> <li style="font-family: 'times new roman', times, serif;"><span style="font-family: 'times new roman', times, serif;">Run hypothesis-driven threat hunts informed by threat intelligence and prior investigations, turning findings into new detections</span></li> <li style="font-family: 'times new roman', times, serif;"><span