Security Incident Response Engineer - Automation & IR Lead

Twitch; San Francisco (CA); On-site; USD 167,000 - 213,000; Full time

Benefits offered by this job

Medical, Dental, Vision & Disability

401(k)

Parental Leave

Flexible PTO

Employee Discounts

Job summary

Twitch is seeking a Security Incident Response Engineer to join its SIRT and drive the detection, handling, and learning from security incidents across the global platform. You will work on-call with the Security Incident Response Team to coordinate responses and improve playbooks for faster containment.

Candidates should have 3+ years in information security, automation scripting, and experience with incident response. Hybrid work in multiple U.S. locations may be considered.

Qualifications

• 3+ years of information security experience or equivalent BS in a related field.
• Automation experience using scripting or programming languages (Go, Python, Ruby, Shell, or Perl).
• Ability to design and implement AI/ML-driven playbooks to automate security operations.
• Experience coordinating responses to security incidents.
• Familiarity with common IR frameworks or lifecycle models (e.g., NIST-800-61, ISO/IEC 27035).

Responsibilities

• Participate in an on-call rotation for the Security Incident Response Team.
• Qualify reports of activity as security incidents using clear guidelines.
• Evaluate impact of security incidents on Twitch and its users.
• Analyze threat actor tactics, techniques, and procedures.
• Coordinate incident response activities with affected teams.
• Document and implement automation in daily security operations.
• Lead lessons learned discussions to reduce incident recurrence.

Skills

Information security

Incident response coordination

Automation scripting

AI/ML playbooks

Threat landscape knowledge

Education

BS in Information Security/CS/CE or related

Tools

Go

Python

Shell

Ruby

Cloud platforms (AWS/GCP)

Job description

Twitch is seeking a Security Incident Response Engineer to join its SIRT and drive the detection, handling, and learning from security incidents across the global platform. You will work on-call with the Security Incident Response Team to coordinate responses and improve playbooks for faster containment.

Candidates should have 3+ years in information security, automation scripting, and experience with incident response. Hybrid work in multiple U.S. locations may be considered.