Security Incident Response Engineer — Automate & Lead IR

Socket.dev; Irvine (CA); On-site; USD 159,000 - 202,000; Full time

Benefits offered by this job

Medical, Dental, Vision & Disability

401(k)

Maternity & Parental Leave

Flexible PTO

Amazon Employee Discount

Job summary

Twitch is seeking a Security Incident Response Engineer to join our SIRT. You will help find, handle, and learn from security incidents across our global platform, coordinating responses and improving processes. You can work from San Francisco, Irvine, or Seattle, with on-call duties and cross-team collaboration.

We value experts who can design AI/ML-driven playbooks, automate common security operations, and communicate timelines and impacts clearly to leadership and peers.

Qualifications

• 3+ years of information security work or related BS degree required.
• Automation experience using Go, Python, Ruby, Shell, or Perl.
• Ability to design and implement AI/ML-driven security playbooks.
• Experience coordinating responses to security incidents.
• Knowledge of security issues and threat landscape.
• Background in cloud, host, network, and application security.
• Familiarity with incident response frameworks (e.g., NIST-800-61, ISO/IEC 27035).

Responsibilities

• Participate in an on-call rotation with the SIRT team.
• Qualify reports or alerts of activity as security incidents using guidelines.
• Evaluate the potential and realized impact of security incidents.
• Analyze threat actor tactics, techniques, and procedures.
• Coordinate incident response activities with affected teams.
• Write and follow clear procedures for repeatable processes.
• Communicate incident timelines and status to peers and leadership.
• Lead lessons learned discussions and drive improvements.

Skills

Incident response

Automation scripting

Cloud security

Threat landscape

AI/ML playbooks

Security coordination

Education

BS in Information Security

BS in Computer Science

MS in CS

Tools

Go

Python

Shell

Ruby

Job description

Twitch is seeking a Security Incident Response Engineer to join our SIRT. You will help find, handle, and learn from security incidents across our global platform, coordinating responses and improving processes. You can work from San Francisco, Irvine, or Seattle, with on-call duties and cross-team collaboration.

We value experts who can design AI/ML-driven playbooks, automate common security operations, and communicate timelines and impacts clearly to leadership and peers.