Engineering Manager, Security (Cloud, Infrastructure & Application Security)

VulnU; United States; Remote; USD 250,000 - 387,000; Full time

Benefits offered by this job

Paid parental leave

Flexible PTO

Retirement match

Equity

Job summary

Replit is seeking an Engineering Manager, Security to lead the teams securing our cloud, infrastructure, and code. You will manage Cloud & Infrastructure Security and Application Security & Secure SDLC groups across GCP, AWS, and Azure, driving remediation to meet SLA and compliance.

You will hire, mentor, and set strategy and roadmaps for vulnerability management and secure-by-default development. You will not handle incident response directly but will support IR with context, prioritization,

Qualifications

• 8+ years in security engineering, cloud security, or DevSecOps.
• Deep knowledge of cloud security across GCP, AWS, Azure.
• Proven track record running vulnerability management programs at scale.
• Experience with CSPM/CNAPP platforms and SCA/SAST/IaC scanning tools.
• Ability to write and review code or automation (Python, Go, TS).
• Familiar with security controls mapping to SOC 2, ISO 27001, PCI DSS, FedRAMP.

Responsibilities

• Lead cloud security, infrastructure vulnerability management, and application security engineers.
• Define multi-year roadmap and quarterly OKRs for security programs.
• Oversee remediation SLAs and compliance mapping to standards.
• Build automated workflows for finding routing, ownership, and SLA tracking.
• Run remediation reviews with leadership and manage risk acceptance processes.
• Partner with Compliance/GRC for audit-ready evidence and external audits.

Skills

Cloud security

Vulnerability management

Secure SDLC

Security leadership

DevSecOps

Tools

Snyk

Semgrep

CodeQL

Checkmarx

Socket

Dependabot

Checkov

tfsec

Job description

# Engineering Manager, Security (Cloud, Infrastructure & Application Security)Replit · replit.comCategory: Application SecurityLocation: RemoteLevel: ManagerSalary: $250,000 – $387,000## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.* Paid parental leave* Flexible PTO* Retirement match* EquityReplit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.About the role:We are looking for an Engineering Manager, Security to lead the teams that secure our cloud, our infrastructure, and the code we ship. You will manage two closely linked groups:Cloud & Infrastructure Security: engineers who own cloud security posture, configuration hardening, and infrastructure vulnerability management across GCP, AWS, and Azure, plus containers, Kubernetes, and SaaS platforms.Application Security & Secure SDLC: engineers who run our SCA, SAST, and IaC scanning programs, drive remediation with engineering teams, and deliver secure development training.The core responsibility of this role is getting vulnerabilities fixed on time. You will partner with engineering teams across the company to drive remediation of cloud, infrastructure, and code findings within SLA, so that we consistently meet our compliance commitments (SOC 2, ISO 27001, PCI DSS, FedRAMP, and customer contracts). You will hire and grow a high-performing team, set the strategy and roadmap for vulnerability management from code to cloud, and make secure-by-default the easiest path for every developer. You will not run incident response yourself, but you need to understand it well enough to support the incident response team with context, prioritization, and follow-up fixes. What You'll Do:Team Leadership & StrategyBuild, lead, and mentor a team of cloud security, infrastructure vulnerability management, and application security engineers; own hiring, career development, and performance management.Define the multi-year roadmap and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC, balancing risk reduction against developer velocity.Set clear ownership, operating rhythms, and on-call/escalation processes across the team.Report on security posture, risk trends, and program metrics to engineering and executive leadership.Remediation & Compliance DeliveryOwn remediation SLAs by severity across cloud, infrastructure, container, and code findings, and make sure they map to our compliance obligations (SOC 2, ISO 27001, PCI DSS, FedRAMP, customer contracts).Partner with engineering managers and tech leads to plan, prioritize, and land fixes within SLA without stalling roadmaps.Run a regular remediation review with engineering leadership: open findings, SLA burn-down, upcoming SLA breaches, and owners.Manage the exception and risk-acceptance process: documented justification, compensating controls, expiry dates, and approvals.Build automated workflows that route findings to the right owning team, track them to closure, and escalate before SLAs are breached.Work with Compliance/GRC to produce audit-ready evidence of remediation timeliness, and lead the security side of external audits for vulnerability management controls.Track and report metrics such as SLA attainment, mean time to remediate, backlog age, and exceptions, by team and severity.Cloud & Infrastructure SecurityLead infrastructure vulnerability management across cloud workloads, containers, registries, data stores, and platform services, from scanning and contextual risk triage to remediation workflows.Oversee configuration hardening and secure baselines across GCP (primary) and supporting AWS and Azure environments.Own the strategy for Cloud, Kubernetes, and Data Security Posture Management (CSPM, KSPM, DSPM) tooling; make sure findings are accurate, prioritized, and actionable.Secure critical SaaS platforms with sound configurations, access controls, and integrations.Partner with Platform and ML Infrastructure teams to secure multi-tenant and AI infrastructure.Application Security & Code ScanningOwn the SCA, SAST, and IaC scanning programs end to end: tool selection, CI/CD integration, rule tuning, noise reduction, and developer experience.Drive software supply chain security, including dependency management, SBOMs, artifact signing, and progress through SLSA levels.Feed code-scanning findings into the central remediation workflow so they reach the owning team automatically and are tracked against SLA.Shift IaC security left so misconfigurations are caught in pull requests, before they reach production.Secure SDLC & Developer EnablementDefine and run the Secure SDLC program: security requirements, threat modeling, secure design reviews, and release gates proportionate to risk.Build and deliver security training, including onboarding, role-based secure coding training, and targeted sessions driven by real vulnerability trends.Develop paved roads, secure defaults, and guardrails that make the secure path the easiest path for engineers.Grow a Security Champions network across engineering teams.Incident Response Partnership & CollaborationUnderstand the incident response lifecycle well enough to support the IR team: supply asset, exposure, and vulnerability context, and help assess blast radius.Own follow-up remediation from incidents and postmortems that touch cloud, infrastructure, or code, and track it to closure.Feed incident learnings back into scanning rules, secure baselines, and developer training.Collaborate with Security Monitoring/Detection, Incident Response, Offensive Security, PSIRT, Architecture, DevOps, and Platform Engineering.Help communicate security advisories, best practices, and updates to customers.Tune into threat intelligence alerts to promptly manage patching of critical, exploitable vulnerabilities. Required Skills & Experience:8+ years in security engineering, cloud security, or DevSecOps, including 2+ years managing security engineers (or 3+ years as a tech lead with formal people-leadership responsibility).Deep, hands-on knowledge of cloud security in GCP plus working knowledge of AWS and/or Azure: IAM, networking, logging, org policies, and security services.Proven track record running vulnerability management programs at scale and driving remediation across many engineering teams to meet SLAs, across cloud infrastructure, containers, and application code.Hands-on experience with CSPM/CNAPP platforms (e.g., Wiz, Orca, Prisma Cloud, Lacework, GCP Security Command Center).Hands-on experience with SCA, SAST, and IaC scanning tools (e.g., Snyk, Semgrep, CodeQL, Checkmarx, Socket, Dependabot, Checkov, tfsec) and integrating them into CI/CD.Strong understanding of Kubernetes and container security, and Infrastructure-as-Code (Terraform or similar).Proven track record of building or maturing a Secure SDLC program, including developer security training.Ability to write and review code or automation (Python, Go, TypeScript, or similar).Strong understanding of how remediation SLAs and security controls map to compliance frameworks (SOC 2, ISO 27001, PCI DSS, FedRAMP, CIS, NIST), and experience producing audit evidence.Working understanding of security incident response in cloud-native environments, enough to partner effectively with IR and detection teams.Excellent communication skills, with the ability to influence engineering leaders and explain risk in business terms.Bonus Qualifications:Experience securing developer platforms, multi-tenant SaaS, or AI/ML infrastructure.Experience with software supply chain frameworks (SLSA, Sigstore, SBOM standards).Experience building a Security Champions program or developer-facing security tooling.Experience leading the security side of external audits (SOC 2 Type II, ISO 27001, PCI DSS, or FedRAMP).Relevant certifications (e.g., CCSP, GCP Professional Cloud Security Engineer, OSCP, CSSLP), though not required.Full-Time Employee Benefits Include: Competitive Salary & Equity 401(k) Program with a 4% match (US Only) Health, Dental, Vision and Life Insurance Short Term and Long Term Disability Paid Parental, Medical, Caregiver Leave Flexible Time Off (FTO) + Holidays Commuter Benefits (In-Office & US Only) Monthly Wellness Stipend Autonomous Work Environment In Office Set-Up Reimbursement (In-Office Only) Quarterly Team Gatherings In Office Amenities (In-Office Only)