Security Engineer - Incident Response

The role

You will lead security incident investigations and serve as an incident commander. You will also build automation, scripts, and tooling to improve response, containment, and detection.

What you will do

• Serve as incident commander or technical lead for security incidents.
• Coordinate response across Security, SRE, Engineering, Legal, and leadership.
• Communicate incident status, impact, and risk to technical and executive audiences.
• Participate in and help shape the security on-call rotation.
• Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers.
• Determine scope, root cause, attacker behavior, and blast radius for confirmed incidents.
• Build scripts, automations, and tools in Python, Go, or Bash.
• Develop and maintain response playbooks and runbooks.
• Integrate response workflows with SIEM, SOAR, ticketing, and chat tooling.
• Turn incident findings into new or improved detections and logging coverage.

Required qualifications

• Proven experience leading or serving as technical lead on security incidents in a cloud or SaaS environment.
• Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis.
• Proficiency writing production-quality scripts or tools in Python, Go, or Bash.
• Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking).
• Working knowledge of Kubernetes and containers.
• Understanding of identity systems, SaaS architectures, and common cloud attack paths.
• Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems.
• Understanding of IR frameworks and lifecycle (for example NIST 800-61).
• Understanding of the vulnerability lifecycle and exploitability analysis.

Nice to have

• Experience building or operating SOAR or other response automation platforms.
• Digital forensics experience with cloud, Linux hosts, or containers.
• Experience with threat intelligence, threat hunting, or security research.
• Experience with bug bounty programs or coordinated vulnerability disclosure.
• Familiarity with detection-as-code practices and writing detection rules.
• Experience in fast-paced, cloud-native, or AI/ML-driven environments.
• Relevant certifications (such as GCIH, GCFA, GCFR), or equivalent hands-on experience.

Benefits

• Competitive Salary & Equity
• 401(k) Program with a 4% match (US Only)
• Health, Dental, Vision and Life Insurance
• Short Term and Long Term Disability
• Paid Parental, Medical, Caregiver Leave
• Flexible Time Off (FTO) + Holidays
• Commuter Benefits (In-Office & US Only)
• Monthly Wellness Stipend
• Autonomous Work Environment
• In Office Set-Up Reimbursement (In-Office Only)
• Quarterly Team Gatherings
• In Office Amenities (In-Office Only)

About the company

Replit is the agentic software creation platform that enables anyone to build applications using natural language. It is democratizing software development by removing traditional barriers to application creation.