The posting
Role Overview:
The Security Engineer serves as a technical leader across Product Security Incident Response (PSIRT), vulnerability management, and customer security incident response. This role protects F5 customers, products, and services by leading complex investigations, coordinating remediation, and communicating actionable security guidance. Working with global, cross-functional teams, the Security Engineer strengthens incident response processes, mentors engineers, and builds a security-focused culture through research, training, and knowledge sharing.
What You’ll Do:
- Uphold F5’s Business Code of Ethics and promptly report violations of the Code or other company policies.
- Deliver high-quality Tier 2 and Tier 3 security support, independently prioritizing complex customer issues and engaging escalation teams when needed.
- Lead security incident investigations, attack analysis, and mitigation efforts, including escalated customer cases and service requests with extended resolution times.
- Monitor, validate, and assess vulnerabilities affecting F5 products and services using internal reports, researcher disclosures, bug bounty submissions, CVEs, and threat intelligence.
- Prioritize vulnerabilities based on severity, exploitability, and customer and business impact; guide risk assessments and coordinate timely remediation with Engineering and other stakeholders.
- Partner with Product Engineering, Product Management, Legal, and Corporate Communications to develop and publish security advisories, mitigations, and fix notifications.
- Manage relationships with external security researchers and collaborate with the broader security community, including CISA, FIRST, VINCE, and other PSIRTs.
- Develop and maintain incident response plans, Quarterly Security Notification (QSN) playbooks, and vulnerability management workflows in alignment with F5’s Quality Management System (QMS).
- Maintain clear incident records, lead or participate in post-mortems, and translate root-cause findings into improvements to products, documentation, and response processes.
- Serve as a technical lead and mentor, identify team skill gaps, and deliver training, hands-on attack simulations, and security awareness sessions.
- Document reusable security knowledge through Knowledge-Centered Service (KCS) practices and use recurring issues to drive continuous improvement.
- Lead cross-functional security initiatives, communicate emerging risks, and provide operational metrics and executive-level reporting on response effectiveness and remediation progress.
- Participate in on-call and weekend support rotations and provide support outside core business hours as needed.
- Perform other related duties as assigned.
What You Bring:
- A minimum of 15 years of experience in technical security roles, such as incident response, security support, monitoring, or consulting.
- A bachelor’s degree or equivalent practical experience.
- Information security subject matter expertise, with extensive experience managing incidents in production environments and coordinating product vulnerability response.
- Expert understanding of CVE, CPE, CVSS, vulnerability assessment, and risk prioritization, along with strong knowledge of security frameworks and NIST standards.
- CISSP, GCIH, or comparable demonstrated skills with the ability to obtain certification; multiple security certifications preferred. Public cloud certification or equivalent demonstrated capability is also expected.
- Expert knowledge of application, network, and infrastructure security, including threat modeling, secure architecture, secure coding, and security testing.
- Extensive experience analyzing and mitigating DDoS, web application, DNS, and other network attacks, with knowledge of malware and common infection vectors.
- Strong hands-on networking expertise, including TCP/IP, TLS/SSL, DNS, HTTP, LAN/WAN environments, packet analysis, and common network architectures.
- Expert experience with WAFs, firewalls, IDS/IPS, vulnerability scanners, and operating system hardening, plus familiarity with load balancers and security monitoring tools.
- Proficiency in Python and additional scripting languages, working knowledge of UNIX/Linux tools, and the ability to analyze code-level vulnerabilities and develop attack proofs of concept.
- Hands-on experience with public cloud platforms such as AWS, Azure, or GCP, and container, orchestration, and automation technologies such as Docker, Kubernetes, Terraform, and Ansible.
- Knowledge of microservices, modern application architectures, and API security.
- Strong analytical, organizational, and leadership skills, with the ability to manage competing priorities independently and collaborate across global teams.
- Good communication skills, with the ability to explain technical risks to customers, engineers, and executives and create effective training content.
- Experience with incident tracking systems; Siebel experience is a plus.
- This role supports regional operations across the Americas, EMEA, and APJ.
- Participation in an on-call rotation is required, including occasional early morning, evening, overnight, weekend, and holiday work.
- Travel may be required up to approximately 20%.
The Job Description is intended to be a general representation of the responsibilities and requirements of the job. However, the description may not be all-inclusive, and responsibilities and requirements are subject to change.
