SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Snowflake is hiring a Security Incident Response Engineer to join its Incident Response team. This role focuses on scaling security operations by pairing autonomous AI agents with human judgment to detect, investigate, and contain threats across Snowflake's rapidly growing cloud and AI infrastructure.
In this position, you will:
- Join a high-impact security team at one of the fastest-growing software companies
- Spearhead an agentic approach to incident response by deploying, guiding, and refining autonomous AI agents that execute initial triage, context gathering, and rapid investigation alongside human Incident Commanders
- Handle escalations, lead security investigations, and act as Incident Commander for critical incidents
- Build scripts, automation pipelines, and agentic workflows that enhance Snowflake's incident response capabilities
- Partner with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams
- Create and improve detections, threat signatures, and guardrails for both traditional and AI-driven attack vectors
- Participate in periodic on-call rotation, which may involve non-traditional working hours
This is an opportunity to shape incident response in the agentic era, working on the front line of defending one of the world's most important data platforms. You will see incidents end-to-end and turn learnings into lasting improvements to how Snowflake protects its customers and people.
REQUIREMENTS:
- 2+ years of relevant experience in incident response or security operations (preferred)
- Strong experience in incident response, security investigations, and running incidents as Incident Commander
- Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads
- Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry to accelerate investigations and threat triage
- Knowledge of securing frontier AI infrastructure, including model training and serving pipelines and AI agent permissions
- Proven ability to detect and respond to modern AI-driven attacks
- Proficiency in Python to build automated orchestration pipelines and programmatically enrich security alerts
- Expert-level understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes)
- Ability to translate incident findings and root-cause analysis into tactical fixes and long-term security engineering objectives
- Ability to perform static and dynamic malware analysis using sandbox environments and modern AI-assisted reverse engineering tools
BONUS QUALIFICATIONS:
- Experience with threat hunting or building detection-as-code programs
- Experience running sensitive investigations alongside Legal and HR, such as insider risk cases
- Familiarity with large-scale data platforms for analyzing security telemetry
- Contributions to open-source security tooling, detection rules, or broader security community
- Industry certifications such as GCIH, GCFA, or GREM
