Incident Response Security Engineer — IR Automation

Replit; Foster City (CA); On-site; USD 170,000 - 250,000; Full time

Benefits offered by this job

Salary & equity

401(k) match

Health insurance

Dental & Vision

Paid leave

Flexible time off

Commuter benefits

Wellness stipend

Office setup reimbursement

Job summary

Replit is seeking a Security Engineer with deep incident response experience to defend a fast-moving, cloud-native platform. You will lead investigations from signal to root cause, coordinate containment with Security, SRE and Engineering, and inform stakeholders during high-velocity incidents.

You will write scripts and tooling to automate triage, evidence collection, and containment, and translate lessons into better detections and platform hardening for faster responses in the future.

Qualifications

• Proven experience leading or managing security incidents in cloud/SaaS
• Strong hands-on investigation with SIEM and cloud logs
• Proficiency scripting in Python/Go/Bash for automation
• Solid knowledge of Google Cloud Platform and GKE
• Working knowledge of Kubernetes and containers
• Understanding of identity systems, SaaS architectures, and cloud attack paths
• Familiarity with IR frameworks (e.g., NIST 800-61) and vulnerability analysis

Responsibilities

• Serve as incident commander for security incidents from detection through containment and post-incident review
• Coordinate response across Security, SRE, Engineering, Legal and leadership
• Communicate incident status, impact and risk to technical and executive audiences
• Develop scripts and tooling to speed up triage, evidence collection, and containment
• Turn incident findings into new detections and improved logging/visibility
• Lead blameless post-incident reviews and drive remediation to completion
• Run tabletop exercises to test readiness and identify gaps

Skills

Incident response

SIEM

Cloud logs

Python

Go

Bash

GCP

Kubernetes

Containers

Identity systems

CI/CD

NIST 800-61

Tools

SOAR

Job description

Replit is seeking a Security Engineer with deep incident response experience to defend a fast-moving, cloud-native platform. You will lead investigations from signal to root cause, coordinate containment with Security, SRE and Engineering, and inform stakeholders during high-velocity incidents.

You will write scripts and tooling to automate triage, evidence collection, and containment, and translate lessons into better detections and platform hardening for faster responses in the future.