SOC Engineer

Replit; United States; Remote; USD 150,000 - 210,000; Full time

Benefits offered by this job

Salary & Equity

401k Match

Health/Dental/Vision

Disability Insurance

Parental & Medical Leave

Flexible Time Off

Commuter Benefits

Wellness Stipend

Autonomous Work Environment

Office Setup Reimbursement

Quarterly Team Gatherings

Office Amenities

Job summary

Replit is seeking a SOC Engineer to join our Security Operations team. You will build and evolve a security data lake, engineer reliable telemetry, and own high-fidelity detection end-to-end across our cloud-native AI vibe-coding platform.

You will unify cloud, identity, endpoint, and application telemetry, monitor emerging threats, and support incident investigations. The role requires hands-on engineering, strong CI/CD and cloud-native experience, especially with GCP.

Qualifications

• Hands-on experience building/maintaining security data lakes and unifying telemetry across cloud, identity, endpoint and app layers.
• Expertise in detection engineering end-to-end: developing, testing and tuning custom rules to maximize coverage while reducing noise.
• Strong software engineering fundamentals (code structure, builds, dependencies, packaging) and familiarity with CI/CD workflows.

Responsibilities

• Architect, expand, and maintain the security data lake and detection rules to maximize threat coverage and minimize noise across the cloud-native stack.
• Continuously monitor emerging threats and rapidly assess their applicability to the company’s infrastructure and services.
• Conduct targeted investigations using SIEM, Cloud Logging, and telemetry to identify gaps and improve visibility and defenses.
• Develop and deploy automation and infrastructure-as-code to close visibility gaps and streamline investigations.

Skills

Security Data Lake

SIEM & Cloud Logging

Detection Engineering

Infrastructure as Code

Cloud: GCP

CI/CD & DevOps

Programming: Python/Go

Kubernetes

Tools

Terraform

Job description

the company is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, the company is democratizing software development by removing traditional barriers to application creation.

About the role:

We are looking for a SOC Engineer to join our Security Operations team and help defend a fast-moving, cloud-native AI vibe-coding platform. In this role, your primary mandate will be building and evolving our security data lake, engineering reliable security telemetry, and owning high-fidelity detection engineering end-to-end. You will unify cloud, identity, endpoint, and application telemetry, staying on top of emerging threats to rapidly build and tune detections across our environment. Alongside this data and detection mandate, you will support incident investigations as needed to translate real-world threats into stronger automated defenses. This is a hands-on engineering role requiring strong technical depth, understanding of modern software engineering and CI/CD systems, familiarity with cloud-native infrastructure (especially GCP), and expertise in security data pipelines and detection workflows.

What You'll Do:

• Security Data Lake & Detection Engineering: Architect, expand, and maintain our security data lake while designing, testing, and tuning custom detection rules to maximize threat coverage and minimize noise across our cloud-native stack.

• Threat Awareness & Rapid Assessment: Continuously monitor emerging threats (0-days, bad actor activity, public exploitation campaigns, bug bounty reports, customer security issues) and rapidly assess their applicability to the company's infrastructure, SaaS services, internal tools, and platform components.

• Investigation & Impact Analysis: Conduct targeted investigations to determine impact, analyze logs, telemetry, and system behaviors using SIEM, metrics, and Cloud Logging and identify gaps in detection/visibility.

Required Skills & Experience:

• Building and evolving the security data lake, unifying cloud, identity, endpoint, and application telemetry; hands-on experience with SIEM, Cloud Logging, and log-based investigation workflows.

• Engineering reliable security infrastructure and automation using infrastructure-as-code to close visibility gaps and perform log-based investigations.

• Proven expertise in detection engineering end-to-end, specifically developing, testing, and tuning custom detection rules to maximize threat coverage and reduce noise across complex environments.

• Strong understanding of software engineering fundamentals (code structure, build systems, dependencies, package ecosystems).

• Understanding of CI/CD pipelines and DevOps workflows.

• Solid knowledge of cloud architecture, especially Google Cloud Platform (GCP) services in modern cloud-native deployments.

• Familiarity with SaaS architectures, identity systems, and integration patterns.

Bonus Qualifications:

• Experience with threat intelligence, security research, or vulnerability analysis.

• Familiarity with Kubernetes, containers, serverless infrastructure, or modern distributed systems.

• Ability to write scripts or small tools for investigation or automation (Python, Go, Bash).

• Experience working with bug bounty programs or coordinated vulnerability disclosure workflows.

• Experience in fast-paced, cloud-native, or AI/ML-driven environments.

Full-Time Employee Benefits Include:

Competitive Salary & Equity

401(k) Program with a 4% match (US Only)

Health, Dental, Vision and Life Insurance

Short Term and Long Term Disability

Paid Parental, Medical, Caregiver Leave

Flexible Time Off (FTO) + Holidays

Commuter Benefits (In-Office & US Only)

Monthly Wellness Stipend

Autonomous Work Environment

In Office Set-Up Reimbursement (In-Office Only)

Quarterly Team Gatherings

In Office Amenities (In-Office Only)

Want to learn more about what we are up to?

• Self-driving Company

• the company Agent at Scale

• AI Adoption

• Build Open-Source Apps

Interviewing + Culture at the company

• Operating Principles

• Reasons not to work at the company

To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.