Security Operations Lead: 24/7 AI-Driven SOC

Segment (Twilio); Foster City (CA); On-site; USD 140,000 - 210,000; Full time

Benefits offered by this job

Health, Dental, Vision

401(k)

Paid time off

Commuter benefits

Wellness stipend

Job summary

Replit is seeking a Security Operations Lead to build and run our 24/7 detection and response across a cloud-native and AI-driven environment. You will lead the global SOC, own SIEM, detection engineering, and alert triage, while integrating AI-based SOC tools.

The role spans monitoring cloud platforms (GCP, AWS, Azure), Kubernetes clusters, SaaS apps, endpoints, and CI/CD pipelines, with a focus on automation, data schemas, and scalable security program.

Qualifications

• 7+ years in Security Operations, with 3+ in senior/lead roles.
• Experience leading or coordinating 24/7 SOC operations (internal, hybrid, or MSSP).
• Hands-on SIEM with Chronicle, Splunk, Elastic or similar platforms.
• Strong cloud security monitoring across GCP, AWS, and Azure.
• Experience with AI-based SOC platforms and automation tooling.

Responsibilities

• Lead global SOC team responsible for 24/7 monitoring, triage, and escalation.
• Define processes, runbooks, SLAs, metrics, and quality standards.
• Own SIEM ingestion, normalization, correlation, and dashboards.
• Develop high-fidelity detections for cloud, identity, and endpoints.
• Drive investigations, containment, and remediation with cross‑functional partners.
• Collaborate with Eng, Cloud Security, and SRE to instrument services.
• Communicate risks and trends to leadership.

Skills

SOC leadership

24/7 monitoring

SIEM expertise

Cloud security monitoring

AI-based SOC tools

Scripting (Python, Go, Bash)

MITRE ATT&CK knowledge

Threat hunting

Identity security

Tools

Chronicle

Splunk

Elastic

Sentinel

Panther

Okta

Job description

Replit is seeking a Security Operations Lead to build and run our 24/7 detection and response across a cloud-native and AI-driven environment. You will lead the global SOC, own SIEM, detection engineering, and alert triage, while integrating AI-based SOC tools.

The role spans monitoring cloud platforms (GCP, AWS, Azure), Kubernetes clusters, SaaS apps, endpoints, and CI/CD pipelines, with a focus on automation, data schemas, and scalable security program.