Security Engineer - Incident Response

About the job

Responsibilities

• Serve as incident commander or technical lead for security incidents, managing the full lifecycle from detection to post-incident review.
• Coordinate response efforts across Security, SRE, Engineering, Legal, and leadership, making critical decisions under pressure.
• Communicate incident status, impact, and risk clearly to both technical and executive audiences.
• Participate in and help shape the security on-call rotation.
• Investigate suspicious activity across cloud infrastructure, containers, identity systems, and applications using various security tools and telemetry.
• Determine the scope, root cause, attacker behavior, and blast radius of confirmed security incidents.
• Quickly assess the applicability of emerging threats and active exploitation campaigns to Replit.
• Build scripts, automations, and tools using Python, Go, or Bash to accelerate incident response tasks like enrichment, evidence collection, and alert triage.
• Develop and automate response playbooks and runbooks.
• Integrate response workflows with SIEM, SOAR, ticketing, and chat tools to reduce time-to-contain.
• Translate incident findings into improved detections, logging coverage, and visibility.
• Lead blameless post-incident reviews and ensure remediation items are completed.
• Conduct tabletop exercises and simulations to test and improve incident response readiness.

Requirements

• Proven experience leading or serving as a technical lead on security incidents in a cloud or SaaS environment.
• Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis, capable of working with large datasets under pressure.
• Proficiency in writing production-quality scripts or tools in Python, Go, or Bash for investigation and automation.
• Solid knowledge of cloud architecture and security, particularly Google Cloud Platform (IAM, audit logging, GKE, networking).
• Working knowledge of Kubernetes and containers, including investigation and containment of compromised workloads.
• Understanding of identity systems, SaaS architectures, and common cloud attack paths.
• Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems.
• Understanding of Incident Response frameworks (e.g., NIST 800-61) and the vulnerability lifecycle.
• Experience building or operating SOAR or other response automation platforms.
• Digital forensics experience with cloud, Linux hosts, or containers.
• Experience with threat intelligence, threat hunting, or security research.
• Experience with bug bounty programs or coordinated vulnerability disclosure.
• Familiarity with detection-as-code practices and writing detection rules.
• Experience in fast-paced, cloud-native, or AI/ML-driven environments.
• Relevant certifications (e.g., GCIH, GCFA, GCFR) or equivalent hands-on experience.

Benefits

• Competitive Salary & Equity
• 401(k) Program with a 4% match (US Only)
• Health, Dental, Vision and Life Insurance
• Short Term and Long Term Disability
• Paid Parental, Medical, Caregiver Leave
• Flexible Time Off (FTO) + Holidays
• Commuter Benefits (In-Office & US Only)
• Monthly Wellness Stipend
• Autonomous Work Environment
• In Office Set-Up Reimbursement (In-Office Only)
• Quarterly Team Gatherings
• In Office Amenities (In-Office Only)