Senior Security Engineer, Detection and Response

About the Role

As a Senior Security Engineer on the Detection & Response team, you will play a key role in detecting, investigating, and responding to security threats across 1Password. You will help mature detection capabilities, respond to complex security incidents, and improve the systems and processes that enable effective security operations. This is a high-impact role with meaningful ownership and the opportunity to shape how detection and response scale together.

Responsibilities

• Design, build, and continuously improve threat detections across 1Password’s infrastructure, products, internal tools, and corporate environments.

• Lead and support security incident response activities, including investigation, containment, remediation, and post‑incident learning.

• Apply threat intelligence and knowledge of attacker TTPs to detection development, threat hunting, alert triage, and response prioritization.

• Collaborate with Security, Infrastructure, and IT teams to improve security visibility, logging quality, and response readiness.

• Use automation, scripting, and Detection‑as‑Code practices to scale detection and response workflows and improve reliability.

• Own end‑to‑end security projects aligned with Detection & Response initiatives and broader security strategy.

• Participate in a shared on‑call rotation and support high‑severity incidents as needed.

• Contribute to operational maturity through playbooks, mentoring, tabletop exercises, audits, and cross‑functional initiatives.

Qualifications

• 5+ years of experience in security technical engineering roles, with 3+ years focused on security operations, detection engineering, or incident response.

• Hands‑on experience with detection engineering and automation, including SIEMs, SOAR platforms, behavior analytics, and Detection‑as‑Code workflows.

• Strong understanding of modern attacker techniques and how they apply to cloud‑native, SaaS, and identity‑centric environments.

• Experience with endpoint, runtime, and forensic tools across multiple operating systems.

• Knowledge of cloud environments (e.g., AWS, GCP) and security best practices for cloud‑native systems.

• Proficiency with scripting and infrastructure tools (e.g., Python, Bash, Terraform, CI/CD pipelines) to support automation and internal tooling.

• Strong written and verbal communication skills, with the ability to explain complex security issues to both technical and non‑technical audiences.

Benefits & Compensation

• USA base salary: $156,000 – $210,000 USD.

• Canada base salary: $143,000 – $193,000 CAD.

• Health, dental, and vision benefits.

• 401(k) with company match.

• Generous paid time off and flexibility.

• Equity grant.

• Retirement matching program.

• Free 1Password account for personal use.

• Paid volunteer days.

• Peer‑to‑peer recognition program.

• Remote‑first work environment.

Remote Work

1Password is a remote‑first company. Employees are expected to work from their home country and may be required to travel for in‑person engagement, such as department offsites, team meetings, and industry events, on a case‑by‑case basis.

EEO & Accommodations

1Password is proud to be an equal‑opportunity employer. We welcome all individuals and do not discriminate on the basis of gender identity and expression, race, ethnicity, disability, sexual orientation, color, religion, creed, gender, national origin, age, marital status, pregnancy, sex, citizenship, education, languages spoken, or veteran status.

Accommodation is available upon request at any point during our recruitment process. If you require an accommodation, please speak to your talent acquisition partner or email

Successful applicants will be required to complete a background check that may consist of prior employment verification, reference checks, education confirmation, criminal background, publicly available social media, credit history, or other information, as permitted by local law.