AI-Driven Incident Response Engineer

Snowflake; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

Snowflake is seeking a Security Incident Response Engineer to join our Incident Response team. You will help redefine incident handling at scale by pairing autonomous AI agents with human judgment to detect, investigate, and contain threats across our cloud footprint.

You will lead security investigations, serve as Incident Commander for critical incidents, and build automation to continuously improve our incident response workflows across Security, Product, and Legal teams.

Qualifications

• 2+ years of incident response or security operations experience.
• Strong incident response, investigations, and incident commander skills.
• Advanced use of security stacks (EDR, SIEM, SOAR, DLP) across endpoints, identities, SaaS, and cloud.
• Familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry.
• Knowledge of securing frontier AI infrastructure (training/serving pipelines).
• Ability to detect and respond to modern AI-driven attacks.
• Proficiency in Python to build automation and enrich alerts.
• Expert understanding of AWS, GCP, or Azure and container runtimes (Docker, Kubernetes).
• Translate findings into tactical fixes and long-term security goals.
• Static and dynamic malware analysis in sandbox environments.

Responsibilities

• Join a high-impact team to scale security at a fast-growing software company.
• Deploy and refine autonomous AI agents for triage, data gathering, and investigations with Incident Commanders.
• Lead escalations, investigations, and act as Incident Commander for critical incidents.
• Build scripts, automation pipelines, and agentic workflows to enhance IR capabilities.
• Collaborate with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams.
• Create and improve detections, threat signatures, and guardrails for AI and traditional vectors.
• Participate in periodic on-call rotations, potentially with non-traditional hours.

Skills

Incident response

Security investigations

Python

AI/LLM tooling

Cloud security

Malware analysis

Incident commander

Tools

Docker

Kubernetes

EDR

SIEM

SOAR

DLP

Job description

Snowflake is seeking a Security Incident Response Engineer to join our Incident Response team. You will help redefine incident handling at scale by pairing autonomous AI agents with human judgment to detect, investigate, and contain threats across our cloud footprint.

You will lead security investigations, serve as Incident Commander for critical incidents, and build automation to continuously improve our incident response workflows across Security, Product, and Legal teams.