Security Incident Response Engineer — Automate & Lead IR

Amazon; San Francisco (CA); On-site; USD 167,000 - 213,000; Full time

Benefits offered by this job

Medical, Dental, Vision & Disability

401(k)

Maternity & Parental Leave

Flexible PTO

Amazon Employee Discount

Job summary

Twitch is seeking a Security Incident Response Engineer to join our SIRT. Reporting to the SIRT Manager, you'll be at the heart of our mission to find, handle, and learn from security incidents across our global platform.

You can work from San Francisco, CA; Irvine, CA; or Seattle, WA, with on-call rotations and the opportunity to improve playbooks, automation, and response across cloud, host, and application security.

Qualifications

• 3+ years of information security experience
• Automation experience with scripting/programming languages (Go, Python, Ruby, Shell, or Perl)
• Ability to design and implement AI/ML-driven playbooks to automate security operations
• Experience coordinating responses to security incidents
• Knowledge of security issues and threat landscape
• Background in cloud, host, network, and application security
• Familiarity with IR frameworks like NIST-800-61, ISO/IEC 27035

Responsibilities

• Participate in an on-call rotation with the SIRT team
• Qualify reports/alerts of activity as security incidents
• Evaluate incident impact on Twitch
• Analyze threat actor tactics, techniques, and procedures
• Participate in information sharing groups and communicate securely
• Write and follow clear procedures for repeatable, measurable work
• Communicate with peers and leadership about incident timelines and actions
• Coordinate incident response activities with affected teams
• Investigate, document, and implement automation in day-to-day processes
• Lead lessons learned discussions to reduce recurrence

Skills

Security incidents

Automation scripting

AI/ML playbooks

Incident coordination

Threat landscape

Cloud security

IR frameworks

Education

Bachelor’s degree in Information Security/CS/Engineering

Job description

Twitch is seeking a Security Incident Response Engineer to join our SIRT. Reporting to the SIRT Manager, you'll be at the heart of our mission to find, handle, and learn from security incidents across our global platform.

You can work from San Francisco, CA; Irvine, CA; or Seattle, WA, with on-call rotations and the opportunity to improve playbooks, automation, and response across cloud, host, and application security.