Security Engineer - Incident Response

About the Role

Lead incident response and investigations for Replit's cloud-native AI platform, coordinating containment and communication across teams. Build automation, tooling, and detections to speed response and harden the platform against cloud attack paths.

Works to protect a cloud-native AI "vibe-coding" platform (Replit) and builds automation to speed incident response for AI-driven development workflows.

Location: Foster City, CA

Salary: USD 230,000 - 360,000/year

Type: Full-time

Posted: Yesterday

Category: Software Engineering

Company Rating: 4.0 (1 reviews)

Vibe Markers: 💻 Open Source, 🔥 Hot

Experience Level: Senior

Job Description

Role

Replit is hiring a Security Engineer focused on Incident Response to lead investigations from first signal to root cause, coordinate containment across Security, SRE, and Engineering, and improve detection and automation to reduce time-to-contain. The role balances hands-on incident response with building scripts, tooling, and playbooks that automate triage, evidence collection, and containment.

Key Responsibilities

Incident Response

• Serve as incident commander or technical lead for security incidents (detection, triage, containment, eradication, recovery, post-incident review).
• Coordinate response across Security, SRE, Engineering, Legal, and leadership; drive decisions under pressure and maintain clear records.
• Communicate status and impact to technical and executive audiences.
• Participate in and shape the security on-call rotation.

Investigation & Forensics

• Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers using SIEM, cloud logs, telemetry, and host/container artifacts.
• Determine scope, root cause, attacker behavior, and blast radius.
• Rapidly assess applicability of emerging threats (0-days, exploitation campaigns, bug bounty findings, customer reports).

IR Automation & Tooling

• Build scripts, automations, and tools (Python, Go, Bash, or directly on Replit) for enrichment, evidence collection, credential/session revocation, workload isolation, and alert triage.
• Develop and maintain response playbooks and runbooks and automate them where possible.
• Integrate response workflows with SIEM, SOAR, ticketing, and chat tooling to reduce time-to-contain.

Detection & Continuous Improvement

• Convert incident findings into improved detections, logging coverage, and visibility.
• Lead blameless post-incident reviews and drive remediation items to completion.
• Run tabletop exercises and simulations to test readiness and find gaps.

Requirements

• Proven experience leading or serving as technical lead on security incidents in cloud or SaaS environments.
• Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis; able to work with large datasets under time pressure.
• Proficiency writing production-quality scripts/tools in Python, Go, or Bash for investigation and automation.
• Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking).
• Working knowledge of Kubernetes and containers, including investigation and containment of compromised workloads.
• Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse).
• Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems.
• Understanding of IR frameworks and lifecycle (for example NIST 800-61) and vulnerability lifecycle/exploitability analysis.

Preferred Qualifications

• Experience building or operating SOAR or other response automation platforms.
• Digital forensics experience with cloud, Linux hosts, or containers.
• Experience with threat intelligence, threat hunting, or security research.
• Experience with bug bounty programs or coordinated vulnerability disclosure.
• Familiarity with detection-as-code practices and writing detection rules.
• Experience in fast-paced, cloud-native, or AI/ML-driven environments.
• Relevant certifications (e.g., GCIH, GCFA, GCFR) or equivalent hands-on experience.

Benefits

• Competitive salary and equity
• 401(k) program with 4% match (US only)
• Health, dental, vision, and life insurance
• Short term and long term disability
• Paid parental, medical, and caregiver leave
• Flexible Time Off (FTO) and holidays
• Commuter benefits (in-office & US only)
• Monthly wellness stipend
• Autonomous work environment
• In-office setup reimbursement and amenities (in-office only)
• Quarterly team gatherings

Tech Stack

Python, Go, Bash, Replit, SIEM, SOAR, Google Cloud Platform (GCP), GKE, Kubernetes, Cloud Logging, Linux, Containers, CI/CD, IAM, NIST 800-61

Skills

Incident Response, Digital Forensics, Automation & Tooling, Scripting, Log Analysis, Cloud Security, Kubernetes, Communication, Leadership, Cross-team Coordination, Threat Hunting, Detection Engineering, CI/CD familiarity, Vulnerability & Exploit Analysis, Playbook and Runbook Development, Post-incident Review, Tabletop Exercises, Collaboration, Ownership, Analytical Reasoning

Benefits

• Competitive Salary
• Equity
• 401(k) matching 4% (US Only)
• Health Insurance
• Dental Insurance
• Vision Insurance
• Life Insurance
• Short Term Disability
• Long Term Disability
• Paid Parental Leave
• Paid Medical Leave
• Paid Caregiver Leave
• Flexible Time Off (FTO)
• Holidays
• Commuter Benefits (In-Office & US Only)
• Monthly Wellness Stipend
• Autonomous Work Environment
• In-Office Setup Reimbursement (In-Office Only)
• Quarterly Team Gatherings
• In-Office Amenities (In-Office Only)