Security Operations

About Us:

Fireworks is the platform for specialized intelligence, enabling companies to build, train, and serve AI models tailored to their own data, workflows, and products. Founded by the team behind PyTorch and backed by AMD, Atreides, Benchmark Capital, Index Ventures, Lightspeed, NVIDIA, Sequoia Capital, and TCV, Fireworks powers production AI with hundreds of state-of-the-art open models across text, image, embedding, audio, and multimodal workloads. Today, Fireworks is a Series D company valued at $17.5 billion, bringing together an ambitious, collaborative team that's building the future of enterprise AI.

About the role

We're hiring our first Security Operations Lead to build and run the SecOps function at Fireworks AI. As we scale our AI infrastructure platform globally, we're investing in a modern detection and response capability anchored on CrowdStrike (EDR and SIEM, 365-day retention), Console AI for ticketing, and Incident.io for on-call and incident management. We have a Security Incident Response Plan (SIRP) in place that you'll build on, and you'll own the function end-to-end: standing up detection content, operationalizing our incident response playbooks, running threat intel into action, and building the operational muscle that keeps Fireworks resilient as we grow. This role sits within the Security team and will primarily support Corporate Security and own incident response broadly, while partnering closely with Security Engineering on infrastructure-related incidents — bridging both areas. This is an IC-to-manager role: you’ll start hands-on building and running the function, growing into a people leader as the team scales.

What you'll do

• Lead the rollout, tuning, and ongoing operation of CrowdStrike across our endpoint and cloud environment and SIEM use cases, partnering with IT and Security Engineering on deployment and coverage

• Define and operate our detection and response program: build detection content, establish triage and escalation workflows, and continuously measure and improve coverage against frameworks like MITRE ATT&CK

• Own incident response end-to-end: operationalize our existing SIRP into detailed playbooks, run incidents, lead post-incident reviews, and drive lessons learned into program improvements

• Stand up our security operations workflow, including SOAR automation with Incident.io for alerting, on-call, and incident orchestration, while also defining how incidents self-submitted through our IT ticketing system are triaged and handled as one-off cases — along with the SLAs and metrics the function runs on