Partner 34, Lead Engineer, Incident Response

Leads a16z's detection and response team in a hands-on role that combines managing its engineers with investigating incidents, writing detections and building automation. The team covers the firm's endpoints, identities, SaaS applications and cloud estate, and the role extends to impersonation and fraud threats particular to venture capital, such as capital call wire fraud and social engineering aimed at partners.

The lead sets the detection and response roadmap and measures coverage, alert quality and response performance. The work includes running major incidents, including those at vendors, coordinating with system owners and providers, and escalating decisions that need leadership or Legal sign-off; keeping playbooks tested through tabletop exercises; designing SIEM architecture and logging with Security Engineering and IT; and writing and tuning detections as code mapped to MITRE ATT&CK. The role also runs intelligence-led threat hunts, builds brand protection covering lookalike domains, fraudulent sites and fake social accounts, develops AI-assisted response automation with clear points for human approval, and leads postmortems through to completed fixes. Coaching, feedback and performance management of the engineers are part of the job, and the lead joins the on-call rotation.

The firm wants nine or more years in incident response or detection and response with depth in AWS and GCP incidents, prior experience managing security engineers while staying technical, strong detection engineering in KQL or Sigma, solid Python, and experience hunting identity compromise and data exfiltration. GCIH is a bonus. The role is hybrid, with two days a week in the San Francisco office.