SOC Engineer

Speedrun Talent Network; Foster City (CA); On-site; USD 140,000 - 200,000; Full time

Benefits offered by this job

Health, Dental, Vision and Life

401(k) with 4% match

Paid parental leave

Flexible time off

Commuter benefits

Wellness stipend

In-office setup reimbursement

Quarterly team gatherings

Job summary

Replit is seeking a SOC Engineer to join the Security Operations team, focusing on building a security data lake, telemetry, and end-to-end detection engineering for a cloud-native AI vibe-coding platform.

You will unify cloud, identity, endpoint, and application telemetry, monitor emerging threats, and support incident investigations to translate threats into automated defenses. This hands-on role requires strong software engineering depth, CI/CD familiarity, and modern cloud-native expertise.

Qualifications

• Hands-on experience with SIEM, Cloud Logging, and log-based investigations.
• Infrastructure-as-code to automate security infrastructure and close visibility gaps.
• End-to-end detection engineering: develop, test, and tune custom rules to maximize threat coverage and reduce noise.
• Strong understanding of software engineering fundamentals, build systems, dependencies, and package ecosystems.
• Knowledge of CI/CD pipelines and DevOps workflows.
• Solid knowledge of Google Cloud Platform (GCP) services in cloud-native deployments.
• Familiarity with SaaS architectures, identity systems, and integration patterns.

Responsibilities

• Architect, expand, and maintain the security data lake and design, test, and tune detection rules.
• Monitor emerging threats and assess applicability to Replit's infrastructure, SaaS services, internal tools, and platform components.
• Conduct targeted investigations to determine impact, analyze logs and telemetry, and identify gaps in detection/visibility.

Skills

SIEM

Cloud Logging

Detection Engineering

Cloud-native

CI/CD

DevOps

GCP

SaaS architectures

Threat awareness

Tools

Kubernetes

Python

Go

Bash

Job description

Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.

About the role:

We are looking for a SOC Engineer to join our Security Operations team and help defend a fast-moving, cloud-native AI vibe-coding platform. In this role, your primary mandate will be building and evolving our security data lake, engineering reliable security telemetry, and owning high-fidelity detection engineering end-to-end. You will unify cloud, identity, endpoint, and application telemetry, staying on top of emerging threats to rapidly build and tune detections across our environment. Alongside this data and detection mandate, you will support incident investigations as needed to translate real-world threats into stronger automated defenses. This is a hands-on engineering role requiring strong technical depth, understanding of modern software engineering and CI/CD systems, familiarity with cloud-native infrastructure (especially GCP), and expertise in security data pipelines and detection workflows.

What You’ll Do:

• Security Data Lake & Detection Engineering: Architect, expand, and maintain our security data lake while designing, testing, and tuning custom detection rules to maximize threat coverage and minimize noise across our cloud-native stack.

• Threat Awareness & Rapid Assessment: Continuously monitor emerging threats (0-days, bad actor activity, public exploitation campaigns, bug bounty reports, customer security issues) and rapidly assess their applicability to Replit's infrastructure, SaaS services, internal tools, and platform components.

• Investigation & Impact Analysis: Conduct targeted investigations to determine impact, analyze logs, telemetry, and system behaviors using SIEM, metrics, and Cloud Logging and identify gaps in detection/visibility.

Required Skills & Experience:

• Building and evolving the security data lake, unifying cloud, identity, endpoint, and application telemetry; hands-on experience with SIEM, Cloud Logging, and log-based investigation workflows.

• Engineering reliable security infrastructure and automation using infrastructure-as-code to close visibility gaps and perform log-based investigations.

• Proven expertise in detection engineering end-to-end, specifically developing, testing, and tuning custom detection rules to maximize threat coverage and reduce noise across complex environments.

• Strong understanding of software engineering fundamentals (code structure, build systems, dependencies, package ecosystems).

• Understanding of CI/CD pipelines and DevOps workflows.

• Solid knowledge of cloud architecture, especially Google Cloud Platform (GCP) services in modern cloud-native deployments.

• Familiarity with SaaS architectures, identity systems, and integration patterns.

Bonus Qualifications:

• Experience with threat intelligence, security research, or vulnerability analysis.

• Familiarity with Kubernetes, containers, serverless infrastructure, or modern distributed systems.

• Ability to write scripts or small tools for investigation or automation (Python, Go, Bash).

• Experience working with bug bounty programs or coordinated vulnerability disclosure workflows.

• Experience in fast-paced, cloud-native, or AI/ML-driven environments.

Full-Time Employee Benefits Include:

• Competitive Salary & Equity
• 401(k) Program with a 4% match (US Only)
• Health, Dental, Vision and Life Insurance
• Short Term and Long Term Disability
• Paid Parental, Medical, Caregiver Leave
• Flexible Time Off (FTO) + Holidays
• Commuter Benefits (In-Office & US Only)
• Monthly Wellness Stipend
• Autonomous Work Environment
• In Office Set-Up Reimbursement (In-Office Only)
• Quarterly Team Gatherings
• In Office Amenities (In-Office Only)

Want to learn more about what we are up to?

• Self-driving Company
• Replit Agent at Scale
• AI Adoption
• Build Open-Source Apps

Interviewing + Culture at Replit

• Operating Principles
• Reasons not to work at Replit

To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.