# Principal Incident Responder

**Company:** [Fluidstack](https://hotfix.jobs/companies/fluidstack)
**Location:** San Francisco, CA, New York, NY
**Role:** Security Engineering
**Salary:** $270k – $370k/yr
**Skills:** Incident Response, Runbook Development, Security Operations, Threat Modeling, On-Call Rotation Management, Root Cause Analysis, KPI Tracking, Tabletop Exercises, Regulatory Disclosure, Ot/Ics Security
**Posted:** 2026-05-15

> Lead material incident response as the most senior commander. Build and run the full IR program including runbooks, on-call processes, agent-human coordination, and cross-functional remediation for AI infrastructure.

## Job Description

## Responsibilities
- Run material incidents as incident commander, coordinating across detection, response, physical security, data center operations, legal, communications, and customers.
- Build the IR program: runbook standards, severity definitions, materiality methodology, evidence contracts, and post-incident review cadence.
- Define the agent-human contract for response: escalation criteria, evidence packages required from agents, and human verdict feedback into agent quality.
- Design and operate the senior-IR on-call rotation (ack SLAs, escalation chain, fan-out logic) and remain an active senior IC inside it.
- Analyze incident trends and patterns to surface systemic risks and recurring root causes, and turn the learnings into runbook, detection, or program improvements.
- Drive cross-functional follow-through after every significant incident, tracking remediation and systemic fixes to completion across detection, response, infrastructure, and other teams.
- Define and track the IR program’s KPIs and report on them to security and engineering leadership.
- Set the tabletop and exercise cadence for IR readiness, executive crisis-comms, and audit-readiness drills.
- Carry the external face of IR for regulatory and customer disclosure obligations, and audit responses.

## Requirements
- Run material incidents at companies with sophisticated threat models, as the most senior commander on the call.
- Made disclosure-grade calls under regulatory and customer reporting clocks.
- Written runbooks that other engineers followed under pressure, and rewritten them after they did not work.
- Built operational processes from the ground up in environments where structure did not previously exist.
- Move fluently between technical containment and executive, legal, or customer-facing conversations during a declared incident.
- See what is needed, scope it yourself, and run with it.

## Similar roles

- [Principal Engineer, Authentication](https://hotfix.jobs/jobs/cfc519a1-18ad-4c8a-a0a5-3eaef7bcb021) - Databricks - Remote - $266k – $366k/yr
- [Principal Network Architect](https://hotfix.jobs/jobs/3584c0be-b75f-4706-b7b8-91e38b0d4c19) - Crusoe - San Francisco, CA - $265k – $310k/yr
- [Principal Engineer, Identity Data Security and Trust](https://hotfix.jobs/jobs/0ff2672d-1150-4f90-811b-c5c8176f98ea) - Snowflake - Menlo Park, CA - $264k – $380k/yr
- [Principal Security Engineer, Infrastructure Security](https://hotfix.jobs/jobs/d8d28d9c-8c13-486a-803c-cf5582aafe17) - OpenAI - Remote - $278k – $490k/yr
- [Principal Security Engineer, Infrastructure Security](https://hotfix.jobs/jobs/5e61c645-1763-45c7-8af9-b4bad88dca3d) - OpenAI - Remote - $278k – $490k/yr

**Apply:** https://hotfix.jobs/jobs/f1352550-ab89-49dc-a355-20eaa996e9bf
**Canonical:** https://hotfix.jobs/jobs/f1352550-ab89-49dc-a355-20eaa996e9bf