Engineering Manager, Investigations and Incident Response

Details

Airbnb was born in 2007 when two hosts welcomed three guests to their San Francisco home, and has since grown to over 5 million hosts who have welcomed over 2 billion guest arrivals in almost every country across the globe. Every day, hosts offer unique stays and experiences that make it possible for guests to connect with communities in a more authentic way.

The Threat Detection and Response team (TDR) at Airbnb is focused on automating security detection, responding to security incidents, and working with partner teams to build capabilities that support the incident lifecycle. This is the front-line team that detects, investigates, and responds to security threats and malicious activity.

Responsibilities

• Define and execute new approaches to detecting, containing, and mitigating security threats and incidents, driving maturity for investigations and response capabilities.
• Own incident response and investigation outcomes, leading end-to-end response across identification, containment, eradication, and recovery.
• Shape team operations—evolving operating models, guiding execution during incidents, and scaling through automation and engineering.
• Assess current capabilities and chart the path forward across people, process, and technology to support effective global response.
• Scale the function through automation, tooling, and improved workflows—solving repeatable problems with systems rather than manual effort.
• Serve as a key voice to senior leadership, communicating incident trends, risks, and strategic direction; partner across the company to convert incident learnings into durable security improvements.
• Lead and mentor a diverse team of ~5+ senior engineers; recruit, develop, and retain top talent.
• Act as a senior escalation point during high-severity or complex incidents and ensure consistent, high-quality investigations with strong root cause analysis.
• Establish priorities that balance speed, depth, and risk reduction; improve escalation paths, ownership clarity, and cross-functional coordination.
• Define and track key metrics such as MTTD, MTTR, incident severity, and recurrence.
• Partner with Security Platform and Detection Engineering, Infrastructure Security, Application Security, Legal, Privacy, Global Safety and Security, and engineering teams to drive effective remediation and improve telemetry, context, and response capabilities.

Requirements

• 9+ years of industry experience in threat detection and incident response, with a minimum of 3–5 years in engineering management.
• Experience shaping or evolving incident response programs in complex environments.
• Exceptional people management and mentorship skills, with a history of recruiting, developing, and retaining top talent.
• Strong understanding of attacker behavior and frameworks such as MITRE ATT&CK.
• Experience and understanding of technologies such as EDR, SIEM, cloud environments, and investigation workflows.
• Experience in cloud-native environments (AWS, GCP, Azure).
• Ability to analyze ambiguous situations and make sound, timely decisions.
• Comfort partnering with engineering teams to build scalable solutions and operate at both strategic and tactical levels, from executive communication to incident leadership.
• Experience defining team strategy, priorities, and operating models; strong judgment in risk assessment, escalation, and trade-offs.
• Excellent communication skills across technical and executive audiences.

Your Location

• This position is US - Remote Eligible. The role may include occasional work at an Airbnb office or attendance at offsites, as agreed with your manager.
• You must live in a state where Airbnb, Inc. has a registered entity (see careers.airbnb.com for excluded states). If employed by another Airbnb entity, your recruiter will confirm eligible states.

Pay Range

• $204,000—$255,000 USD (base pay range). This role may also be eligible for bonus, equity, benefits, and Employee Travel Credits. The actual base pay is dependent on factors such as training, transferable skills, work experience, business needs and market demands.

Inclusion & Accommodations

• Airbnb is committed to working with the broadest talent pool possible and encourages all qualified individuals to apply.
• For candidates with disabilities who require reasonable accommodation during the application or interview process, contact [email protected] with your full name, the role, and the accommodation needed.