Security Engineer - Incident Response

Works to protect a cloud-native AI "vibe-coding" platform (Replit) and builds automation to speed incident response for AI-driven development workflows.

About the Role

Lead incident response and investigations for Replit's cloud-native AI platform, coordinating containment and communication across teams. Build automation, tooling, and detections to speed response and harden the platform against cloud attack paths.

Job Description

Role

Replit is hiring a Security Engineer focused on Incident Response to lead investigations from first signal to root cause, coordinate containment across Security, SRE, and Engineering, and improve detection and automation to reduce time-to-contain. The role balances hands-on incident response with building scripts, tooling, and playbooks that automate triage, evidence collection, and containment.

Key Responsibilities

• Serve as incident commander or technical lead for security incidents (detection, triage, containment, eradication, recovery, post-incident review).
• Coordinate response across Security, SRE, Engineering, Legal, and leadership; drive decisions under pressure and maintain clear records.
• Communicate status and impact to technical and executive audiences.
• Participate in and shape the security on-call rotation.
• Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers using SIEM, cloud logs, telemetry, and host/container artifacts.
• Determine scope, root cause, attacker behavior, and blast radius.
• Rapidly assess applicability of emerging threats (0-days, exploitation campaigns, bug bounty findings, customer reports).

IR Automation & Tooling

• Build scripts, automations, and tools (Python, Go, Bash, or directly on Replit) for enrichment, evidence collection, credential/session revocation, workload isolation, and alert triage.
• Develop and maintain response playbooks and runbooks and automate them where possible.
• Integrate response workflows with SIEM, SOAR, ticketing, and chat tooling to reduce time-to-contain.

Detection & Continuous Improvement

• Convert incident findings into improved detections, logging coverage, and visibility.
• Lead blameless post-incident reviews and drive remediation items to completion.
• Run tabletop exercises and simulations to test readiness and find gaps.

Requirements

• Proven experience leading or serving as technical lead on security incidents in cloud or SaaS environments.
• Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis; able to work with large datasets under time pressure.
• Proficiency writing production-quality scripts/tools in Python, Go, or Bash for investigation and automation.
• Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking).
• Working knowledge of Kubernetes and containers, including investigation and containment of compromised workloads.
• Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse).
• Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems.
• Understanding of IR frameworks and lifecycle (for example "NIST 800-61") and vulnerability lifecycle/exploitability analysis.

Preferred Qualifications

• Experience building or operating SOAR or other response automation platforms.
• Digital forensics experience with cloud, Linux hosts, or containers.
• Experience with threat intelligence, threat hunting, or security research.
• Experience with bug bounty programs or coordinated vulnerability disclosure.
• Familiarity with detection-as-code practices and writing detection rules.
• Experience in fast-paced, cloud-native, or AI/ML-driven environments.
• Relevant certifications (e.g., GCIH, GCFA, GCFR) or equivalent hands-on experience.
• Competitive salary and equity
• 401(k) program with 4% match (US only)
• Health, dental, vision, and life insurance
• Short term and long term disability
• Paid parental, medical, and caregiver leave
• Flexible Time Off (FTO) and holidays
• Commuter benefits (in-office & US only)
• Monthly wellness stipend
• Autonomous work environment
• In-office setup reimbursement and amenities (in-office only)
• Quarterly team gatherings

Skills

Incident Response Digital Forensics Automation & Tooling Scripting Log Analysis Cloud Security Kubernetes Communication Leadership Cross-team Coordination Threat Hunting Detection Engineering CI/CD familiarity Vulnerability & Exploit Analysis Playbook and Runbook Development Post-incident Review Tabletop Exercises Collaboration Ownership Analytical Reasoning

Experience Level

Experience Level

USD 230,000 - 360,000/year

Employment Type

Full-time

• 401(k) matching 4% (US Only)
• Dental Insurance
• Paid Medical Leave
• Paid Caregiver Leave
• Commuter Benefits (In-Office & US Only)
• Monthly Wellness Stipend