Harvey
Incident Handler
$134K–$200K
New York · Full-time · Posted Oct 9, 2026
- Experience
- 3+ years in Incident Response, Detection & Response, Security Operations, Threat Detection, or related security engineering disciplines.
About the job
Leads security incident investigations and response, coordinates containment and follow-up fixes, and helps build Harvey’s Detection & Response function.
What you'll do
- Lead investigations across cloud infrastructure, identity systems, corporate environments, and AI platforms; coordinate containment.
- Use and contribute to an internally developed agentic SOC and help advance the Detection & Response roadmap, including metrics, SLAs, threat modeling, and tabletop exercises.
- Drive incident follow-ups to closure; develop playbooks and operational standards, and mentor engineers and incident responders.
What they ask for
- Experience investigating and responding to complex security incidents in cloud-native environments.
- Deep understanding of attacker tactics, techniques, and procedures, including MITRE ATT&CK and modern threat actor tradecraft.
- Experience with one or more major cloud platforms (AWS, GCP, Azure), plus knowledge of operating systems, networking, and identity systems.
- Experience building security automation and tooling, strong scripting or software engineering skills in Python, Go, or similar languages, and communicating incident status and risk to senior leadership.
Pay
$133,600 - $200,400 USD (base salary)
Tools
AWS, GCP, Azure, MITRE ATT&CK, Python, Go
AI focus
Use and maintain an internally developed agentic SOC fine-tuned to Harvey’s threat environment; investigate incidents affecting AI platforms.
Model-written summary · the original posting is authoritative