STEM OPT Incident Response Engineer Jobs
Incident Response Engineer roles in threat detection, forensic analysis, and security operations qualify for the STEM OPT 24-month extension when your degree maps to an eligible CIP code. Your employer must be enrolled in E-Verify and sign a Form I-983 training plan before your extension begins.
Find STEM OPT Incident Response Engineer JobsOverview
Showing 5 of 10+ Incident Response Engineer jobs
See all Incident Response Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Incident Response Engineer roles.
Get Access To All JobsINTRODUCTION
The world of digital assets is accelerating in speed, magnitude, and complexity, opening the door to new ways for leveraging the blockchain. Fireblocks’ platform and network provide the simplest and most secure way for companies to work with digital assets and it is trusted by some of the largest financial institutions, banks, globally-recognized brands, and Web3 companies in the world, including BNY Mellon, BNP Paribas, ANZ Bank, Revolut, and thousands more.
ABOUT THE TEAM
The SRE Incident Response team is responsible for handling critical application/infrastructure alerts, orchestrating the war room process and enabling first class observability and alerting systems. Team members are located in several international locations (“follow the sun” model) to provide 24/7 availability. We are a team of unique individuals, experienced and independent, who get things done. On-call coverage is 7 days a week, starting at noon, with the shift ending at 6:00pm. This position is fully remote, candidates required to be in US Pacific time.
As part of your role, you would improve and establish new monitoring, alerting, and observability of services using a wide range of tools. Additionally, you would handle critical alerts and incidents and work directly with engineering and DevOps to improve and optimize availability.
- Manage and participate in incident war rooms, escalating and coordinating response for critical workflow alerts.
- Perform deep-dive troubleshooting for application, transaction, and general technical issues.
- Research Fireblocks blockchain workflows, identify optimization opportunities, issues, and improve monitoring.
- Help identify root causes for incidents and prevent them from happening again. Solve and orchestrate outages by working with multiple teams.
- Improve and establish alerting for our infrastructure, services, and business logic.
- Work closely with the R&D and Support: offering education and guidance on integration, support, and monitoring across the toolset.
- Communicate and escalate issues to senior management in R&D and support, write RCAs, and define next steps.
- Document actions in runbooks and then into automation using Python, Lambda, shell scripts, ArgoCD, and Ansible.
- Focus on the system's observability, availability, reliability, performance/latency, and monitoring.
WHAT YOU'LL BRING
- At least 3+ years of experience as an SRE incident response engineer.
- You are curious, self-motivated, easy to work with, responsible, and production-aware—fast learner and able to take a project from POC to production, while handling decision-making and communication.
- Experience with Coding languages - Python/JavaScript/Bash (Must).
- At least 3+ years of experience with Alerting & Monitoring systems such as DataDog, Coralogix / Splunk / New Relic / Prometheus.
- Experience working with Linux systems from kernel to shell and beyond.
- Cloud systems such as AWS / Google Cloud / Azure.
- Experience with Docker, Kubernetes, and Helm.
- SCM - Git/bitbucket/gitlab.
- High Analytical & Troubleshooting skills - ability to solve complex problems.
- Strong verbal and written communication skills and a collaborative mindset.
WANT TO STAND OUT FROM THE CROWD?
- Previous experience in cryptocurrencies / blockchains - a big advantage.
- In-depth knowledge in: Linux optimization, nginx, ArgoCD, DataDog, MySQL.
- Previous experience as a C++ or Node developer.
- BSC in Computer Science or related technical certifications.
For employees hired to work remotely from New York, or from our NYC HQ, Fireblocks is required by law to include a reasonable estimate of the compensation range for this role. This range is specific to New York City and takes into consideration a wide range of factors that are reviewed when making a hiring decision, such as years of experience, skills, and other business needs.
It is not typical for a candidate to be hired at or near the top of the pay range and each compensation decision is dependent on each individual case. A reasonable base salary range estimate for this position is $150,000 - $185,000. The base salary is one component of the total compensation package, which for some roles may include a target bonus, a very competitive equity grant, and very generous benefits.
While we believe competitive compensation is a critical aspect of your decision to join us, we do hope you also spend time considering why our mission and culture are right for you. We are creating something transformational here, and we hope you are as excited about the future as we are.
Fireblocks' mission is to enable every business to easily and securely access digital assets and cryptocurrencies. In order to do that, we strongly believe our workforce should be as diverse as our clients, and this is why we embrace diversity and inclusion in all its forms.
INTRODUCTION
The world of digital assets is accelerating in speed, magnitude, and complexity, opening the door to new ways for leveraging the blockchain. Fireblocks’ platform and network provide the simplest and most secure way for companies to work with digital assets and it is trusted by some of the largest financial institutions, banks, globally-recognized brands, and Web3 companies in the world, including BNY Mellon, BNP Paribas, ANZ Bank, Revolut, and thousands more.
ABOUT THE TEAM
The SRE Incident Response team is responsible for handling critical application/infrastructure alerts, orchestrating the war room process and enabling first class observability and alerting systems. Team members are located in several international locations (“follow the sun” model) to provide 24/7 availability. We are a team of unique individuals, experienced and independent, who get things done. On-call coverage is 7 days a week, starting at noon, with the shift ending at 6:00pm. This position is fully remote, candidates required to be in US Pacific time.
As part of your role, you would improve and establish new monitoring, alerting, and observability of services using a wide range of tools. Additionally, you would handle critical alerts and incidents and work directly with engineering and DevOps to improve and optimize availability.
- Manage and participate in incident war rooms, escalating and coordinating response for critical workflow alerts.
- Perform deep-dive troubleshooting for application, transaction, and general technical issues.
- Research Fireblocks blockchain workflows, identify optimization opportunities, issues, and improve monitoring.
- Help identify root causes for incidents and prevent them from happening again. Solve and orchestrate outages by working with multiple teams.
- Improve and establish alerting for our infrastructure, services, and business logic.
- Work closely with the R&D and Support: offering education and guidance on integration, support, and monitoring across the toolset.
- Communicate and escalate issues to senior management in R&D and support, write RCAs, and define next steps.
- Document actions in runbooks and then into automation using Python, Lambda, shell scripts, ArgoCD, and Ansible.
- Focus on the system's observability, availability, reliability, performance/latency, and monitoring.
WHAT YOU'LL BRING
- At least 3+ years of experience as an SRE incident response engineer.
- You are curious, self-motivated, easy to work with, responsible, and production-aware—fast learner and able to take a project from POC to production, while handling decision-making and communication.
- Experience with Coding languages - Python/JavaScript/Bash (Must).
- At least 3+ years of experience with Alerting & Monitoring systems such as DataDog, Coralogix / Splunk / New Relic / Prometheus.
- Experience working with Linux systems from kernel to shell and beyond.
- Cloud systems such as AWS / Google Cloud / Azure.
- Experience with Docker, Kubernetes, and Helm.
- SCM - Git/bitbucket/gitlab.
- High Analytical & Troubleshooting skills - ability to solve complex problems.
- Strong verbal and written communication skills and a collaborative mindset.
WANT TO STAND OUT FROM THE CROWD?
- Previous experience in cryptocurrencies / blockchains - a big advantage.
- In-depth knowledge in: Linux optimization, nginx, ArgoCD, DataDog, MySQL.
- Previous experience as a C++ or Node developer.
- BSC in Computer Science or related technical certifications.
For employees hired to work remotely from New York, or from our NYC HQ, Fireblocks is required by law to include a reasonable estimate of the compensation range for this role. This range is specific to New York City and takes into consideration a wide range of factors that are reviewed when making a hiring decision, such as years of experience, skills, and other business needs.
It is not typical for a candidate to be hired at or near the top of the pay range and each compensation decision is dependent on each individual case. A reasonable base salary range estimate for this position is $150,000 - $185,000. The base salary is one component of the total compensation package, which for some roles may include a target bonus, a very competitive equity grant, and very generous benefits.
While we believe competitive compensation is a critical aspect of your decision to join us, we do hope you also spend time considering why our mission and culture are right for you. We are creating something transformational here, and we hope you are as excited about the future as we are.
Fireblocks' mission is to enable every business to easily and securely access digital assets and cryptocurrencies. In order to do that, we strongly believe our workforce should be as diverse as our clients, and this is why we embrace diversity and inclusion in all its forms.
See all STEM OPT Incident Response Engineer Jobs
Sign up for free to unlock all listings, filter by visa type, and get alerts for new STEM OPT Incident Response Engineer Jobs.
Get Access To All JobsTips for Finding STEM OPT Authorization as an Incident Response Engineer
Verify your CIP code before applying
Confirm your degree's Classification of Instructional Programs code maps to a STEM-designated field like Computer Science or Information Security. Your DSO can check your I-20 against the official STEM CIP list, a mismatch disqualifies you from the 24-month extension regardless of your job duties.
Screen employers for E-Verify enrollment early
Incident Response Engineer roles often sit inside security or IT operations teams at companies that don't always advertise their E-Verify status. Ask the recruiter directly during a first call, STEM OPT is void if your employer isn't enrolled in E-Verify before your extension start date.
Negotiate your I-983 training plan before accepting
Your employer must complete Form I-983 detailing how your Incident Response duties connect to your STEM degree. Raise this before signing an offer, some hiring managers in security operations have never filed one, and delays getting it signed can push your extension start date.
Use Migrate Mate to target verified sponsors
Search Incident Response Engineer roles on Migrate Mate, which filters for employers with confirmed E-Verify enrollment and active STEM OPT hiring history. This cuts out the manual verification step and surfaces companies already familiar with the I-983 and 24-month extension process.
Map your resume to O*NET's IR Engineer tasks
Pull the Incident Response Engineer occupation profile from O*NET and align your resume skills to its listed tasks: threat containment, forensic investigation, and post-incident reporting. Employers filing STEM OPT extensions reference SOC codes, so matching your experience to standard task language strengthens your I-983 training plan.
Time your H-1B registration around your OPT end date
If your STEM OPT extension runs through an H-1B lottery cycle, cap-gap protection automatically extends your work authorization if you're selected. Submit your registration in March during your final OPT year so any cap-gap gap between October 1 and your extension's expiry is covered by USCIS rules.
Frequently Asked Questions
Does an Incident Response Engineer role qualify for the STEM OPT extension?
Yes, if your underlying degree carries an eligible STEM CIP code and your job duties in threat detection, digital forensics, or security operations directly relate to that field. The role itself doesn't confer eligibility, your degree does. Confirm the CIP code on your I-20 with your DSO before your employer files the I-983 training plan, since USCIS evaluates the degree-to-job connection during any request for evidence.
What does my employer need to do before my STEM OPT extension starts?
Your employer must be enrolled in E-Verify and must sign Form I-983, the Training Plan for STEM OPT Students, before your extension begins. The I-983 requires them to document how your Incident Response duties relate to your STEM degree, set learning objectives, and attest that the position is paid and meets labor standards. You then submit the signed I-983 to your DSO, who issues a new I-20 for the USCIS extension filing.
How do I confirm a company is enrolled in E-Verify before accepting an offer?
Ask the recruiter or HR contact directly whether the company is enrolled in E-Verify. Employers can also be searched through the E-Verify employer search tool maintained by DHS. For security-sector companies that may have government contracts, E-Verify enrollment is often mandatory by federal regulation, but enrollment still needs confirmation, don't assume based on company size or contract status alone.
Which STEM degrees typically support an Incident Response Engineer STEM OPT extension?
Degrees in Computer Science, Information Security, Cybersecurity, Computer Engineering, and Electrical Engineering commonly carry eligible STEM CIP codes. Some programs in Management Information Systems or Applied Mathematics also qualify depending on the specific CIP code your school assigned. A degree titled broadly, like Information Technology, may or may not qualify, so verify the exact CIP code on your I-20 against the DHS STEM Designated Degree Program List before counting on the extension.
Where can I find Incident Response Engineer jobs where employers are already set up to hire STEM OPT students?
Migrate Mate lists Incident Response Engineer positions filtered for employers with E-Verify enrollment and documented STEM OPT hiring activity. That saves you from discovering mid-offer that a company has never processed an I-983 or isn't enrolled in E-Verify. Targeting employers who have already navigated the training plan process significantly reduces the risk of delays between your OPT expiry and extension approval.