Harvey
Incident Handler
$134K–$200K
San Francisco · Full-time · Posted Oct 9, 2026
- Experience
- 3+ years in Incident Response, Detection & Response, Security Operations, Threat Detection, or related security engineering disciplines.
About the job
Leads investigations and response to security incidents across Harvey’s cloud, identity, corporate, and AI environments, while helping build its Detection & Response function.
What you'll do
- Lead incident investigations, coordinate containment, and ensure remediation and follow-up actions are completed.
- Use and maintain an internally developed agentic SOC; contribute to the Detection & Response roadmap, including metrics, SLAs, threat modeling, and tabletop exercises.
- Build playbooks and operational standards, work across teams, and mentor engineers and incident responders.
What they ask for
- Experience investigating and responding to complex incidents in cloud-native environments.
- Deep understanding of attacker tactics, techniques, and procedures, including MITRE ATT&CK and modern threat actor tradecraft.
- Experience with one or more major cloud platforms (AWS, GCP, Azure), and strong knowledge of operating systems, networking, and identity systems.
- Experience building security automation and tooling, strong scripting or software engineering skills, and communicating incident status and risk to senior leadership.
Pay
$133,600 - $200,400 USD (base salary)
Tools
MITRE ATT&CK, AWS, GCP, Azure, Python, Go
AI focus
Use and maintain an internally developed agentic SOC fine-tuned to Harvey’s threat environment, and lead incident investigations involving its AI platforms.
Model-written summary · the original posting is authoritative