Partner 34, Lead Engineer, Incident Response at Andreessen Horowitz

San Francisco, California, United StatesFull-timeCybersecurityPosted 6 days ago

About the Role

Founded in Silicon Valley in 2009 by Marc Andreessen and Ben Horowitz, Andreessen Horowitz (aka a16z) is a venture capital firm that backs bold entrepreneurs <a href="https://a16z.com/news-content">building the future</a> through technology. We are <a href="https://a16z.com/portfolio">stage agnostic</a>. We invest in seed to venture to <a href="https://a16z.com/growth/">growth-stage technology</a> companies, across <a href="https://a16z.com/ai/">AI</a>, <a href="https://a16z.com/bio-health/">bio + healthcare</a>, <a href="https://a16z.com/consumer/">consumer</a>, <a href="https://a16zcrypto.com/">crypto</a>, <a href="https://a16z.com/enterprise/">enterprise</a>, <a href="https://a16z.com/fintech/">fintech</a>, <a href="https://a16z.com/games">games</a>, and companies building toward <a href="https://a16z.com/american-dynamism/">American dynamism</a>. a16z has $100B+ under management across multiple funds. We’ve established a team that <a href="https://a16z.com/about/">is defined by</a> respect for the entrepreneur and the company-building process; we know what it’s like to be in the founder’s shoes. We’ve invested in <a href="https://a16z.com/portfolio/">companies</a> like Anduril, Airbnb, Coinbase, Cursor, Databricks, Deel, Figma, GitHub, Roblox, SpaceX, and Stripe. Our team is at the forefront of new technology, helping founders and their companies impact and change the world. <h2>The Role</h2> We're hiring a Lead Engineer, Incident Response to lead and shape a16z's detection and response team. This is a hands-on role: you'll spend a significant portion of your time investigating incidents, writing and reviewing detections, building automation, and making the harder technical response decisions. You'll also manage and develop the engineers on the team. You'll build and improve detection and response capabilities across the firm's cloud, SaaS, identity, and endpoint environments, shaping the roadmap, tooling, threat hunting, and response practices. You'll also develop capabilities to protect the firm against impersonation and fraud. You'll work closely with Security Engineering, IT, Legal, Compliance, and other cross-functional teams to put these capabilities into practice and turn lessons from incidents into better detections, tooling, and controls. Venture capital firms face threats that extend beyond their infrastructure: capital call wire fraud, impersonation, and social engineering against employees and partners, alongside attacks by organized criminal and nation-state groups. Your work protects sensitive firm and limited partner (LP) information, financial transactions, and the relationships the firm depends on. This role requires an in-office presence 2 days a week in our San Francisco, CA office. <h2>To join our team, you should be excited to: </h2> <ul> <li style="font-family: 'times new roman', times, serif;">Set the detection and response roadmap, prioritizing the threats that matter most to the firm and measuring detection coverage, alert quality, and response effectiveness</li> <li style="font-family: 'times new roman', times, serif;">Lead and develop engineers through coaching, feedback, performance management, and technical reviews, working alongside them on investigations and engineering projects</li> <li style="font-family: 'times new roman', times, serif;">Develop the team's ability to respond from triage through containment, eradication, and recovery, including vendor incidents. Lead major incidents, coordinate a16z's technical response with system owners and affected providers, and escalate decisions requiring leadership or Legal approval</li> <li style="font-family: 'times new roman', times, serif;">Maintain and test response playbooks and escalation criteria through cross-functional tabletop exercises and incident simulations</li> <li style="font-family: 'times new roman', times, serif;">Design and improve SIEM architecture and security logging with Security Engineering and IT, expanding detection coverage across cloud, identity, and endpoint environments, including EDR. Write, review, test, and tune detections as code, using relevant MITRE ATT&CK techniques to assess coverage and working with system owners to close visibility gaps</li> <li style="font-family: 'times new roman', times, serif;">Run hypothesis-driven threat hunts informed by threat intelligence and prior investigations, turning findings into new detections</li> <li style="font-family: 'times new roman', times, serif;">Build and improve brand protection capabilities including monitoring, investigation, and takedowns of lookalike domains, fraudulent websites, and social media accounts</li> <li style="font-family: 'times new roman', times, serif;">Build AI-assisted response automation. Evaluate accuracy and reliability before deployment and define where human judgment and approvals are required</li> <li style="font-family: 'times new roman', times, serif;">Keep technical and non-technical stakeholders aligned during incidents, including IT, Legal, Compliance, Finance, and investing teams. Clearly communicate impact, uncertainty, response options, and next steps</li> <li style="font-family: 'times new roman', times, serif;">Develop the team's postmortem practices, lead reviews of root causes and contributing factors, and drive corrective actions to completion with the teams responsible for remediation</li> <li style="font-family: 'times new roman', times, serif;">Participate in the Security team's on-call rotation</li> </ul> <h2>Minimum Qualifications</h2> <ul> <li style="font-family: 'times new roman', times, serif;">9+ years of incident response or detection and response experience, or equivalent demonstrated impact, with depth in cloud incident response across AWS and GCP</li> <li style="font-family: 'times new roman', times, serif;">Prior experience managing security engineers, including coaching and performance management, while remaining technically hands-on</li> <li style="font-family: 'times new roman', times, serif;">A track record of building and leading detection and response programs, making architecture and prioritization decisions, and delivering measurable improvements</li> <li style="font-family: 'times new roman', times, serif;">Experience leading high-stakes incidents across cloud, SaaS, identity, and endpoint environments, including forensic investigation, containment, recovery, and postmortems</li> <li style="font-family: 'times new roman', times, serif;">Strong detection engineering skills, including SIEM query languages or rule formats such as KQL or Sigma, detection-as-code, testing, and tuning</li> <li style="font-family: 'times new roman', times, serif;">Experience designing SIEM and security log pipelines and using cloud logs, endpoint detection and response (EDR), and security orchestration and automation (SOAR) tools in investigations and response. We value transferable capability over experience with a specific product</li> <li style="font-family: 'times new roman', times, serif;">Experience running hypothesis-driven threat hunts and investigating sophisticated attacks, including identity compromise, social engineering, and data exfiltration</li> <li style="font-family: 'times new roman', times, serif;">Strong Python skills and experience building and reviewing maintainable security automation</li> <li style="font-family: 'times new roman', times, serif;">Working knowledge of AI and agent systems, including their limitations and security risks when used in triage and response workflows</li> <li style="font-family: 'times new roman', times, serif;">Experience leading cross-functional security work and communicating incident impact, uncertainty, and technical trade-offs clearly to non-technical stakeholders and senior leaders</li> <li style="font-family: 'times new roman', times, serif;">Sound judgment under pressure, balancing security risk and business impact and recognizing when to escalate</li> <li style="font-family: 'times new roman', times, serif;">Low ego, high empathy, and a track record of effective collaboration across teams</li> </ul> GCIH or an equivalent incident response certification is a bonus but not required. The anticipated salary range for this role is between $295,000 - $347,000, actual starting pay may vary based on a range of factors which can include experience, skills, and scope. This role is eligible to participate in the a16z carry program and various discretionary bonus programs as well as benefit and perquisite plans including health, dental, vision, disability, life insurance, 401K plan, vacation, and sick leave.<div class="content-conclusion"><h2>a16z culture </h2> <ul> <li style="font-weight: 400; font-family: 'times new roman', times, serif;">We do only first class business and only in a first class way</li> <li style="font-weight: 400; font-family: 'times new roman', times, serif;">We take a long view of relationships, because we are in the relationship business </li> <li style="font-weight: 400; font-family: 'times new roman', times, serif;">We believe in the future and bet the firm that way</li> <li style="font-weight: 400; font-family: 'times new roman', times, serif;">We are all different, we recognize that, and we win</li> <li style="font-weight: 400; font-family: 'times new roman', times, serif;">We celebrate the good times</li> <li style="font-weight: 400; font-family: 'times new roman', times, serif;">We do it for the team</li> <li style="font-weight: 400; font-family: 'times new roman', times, serif;">We play to win</li> </ul> At a16z we are always looking to hire the absolute best talent and recognize that diversity in our experiences and backgrounds is what makes us stronger. We hire candidates of any race, color, ancestry, religion, sex, national origin, sexual orientation, gender identity, age, marital or family status, disability, Veteran status, and any other status. These differences are what enables us to work towards the future we envision for ourselves, our portfolio companies, and the World. Our organization participates in E-Verify. Click<a href="https://www.e-verify.gov/employees" target="_blank" data-saferedirecturl="https://www.google.com/url?q=https://www.e-verify.gov/employees&source=gmail&ust=1674233464432000&usg=AOvVaw1-yT1T3ug2xE734Ge62fLD"> here</a> to learn about E-Verify. Andreessen Horowitz hereby reserves the right to make use of any unsolicited resumes received from outside recruiting agencies and / or individual recruiters without being responsible for payment of any fees asserted from the use of unsolicited resumes.</div>

About the Role

Related Roles