SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Replit is seeking a Security Engineer with deep incident response expertise to lead security incident investigations and response at a fast-growing, cloud-native AI platform. You will serve as incident commander or technical lead during security events, coordinating response across Security, SRE, Engineering, Legal, and leadership. You'll drive decisions under pressure, maintain clear records of actions, and communicate incident status to both technical and executive stakeholders.
Beyond pure response, you'll build automation and tooling to reduce manual work in triage, evidence collection, and containment. You'll investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers using SIEM, cloud logging, telemetry, and host/container artifacts. You'll determine scope, root cause, attacker behavior, and blast radius for confirmed incidents, and quickly assess whether emerging threats (0-days, active campaigns, bug bounty findings) affect Replit.
You'll develop scripts and automations in Python, Go, or Bash to speed up response workflows, including automated enrichment, credential/session revocation, workload isolation, and alert triage. You'll create and maintain response playbooks and runbooks, integrating them with SIEM, SOAR, ticketing, and chat tools. You'll also turn incident findings into improved detections, logging coverage, and visibility, lead blameless post-incident reviews, and run tabletop exercises to test readiness.
REQUIREMENTS:
- Proven experience leading or serving as technical lead on security incidents in cloud or SaaS environments
- Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis; comfortable working through large datasets under time pressure
- Production-quality scripting proficiency in Python, Go, or Bash for investigation and automation
- Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking)
- Working knowledge of Kubernetes and containers, including investigation and containment of compromised workloads
- Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse)
- Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems
- Understanding of IR frameworks and lifecycle (e.g., NIST 800-61), vulnerability lifecycle, and exploitability analysis
PREFERRED QUALIFICATIONS:
- Experience building or operating SOAR or response automation platforms
- Digital forensics experience with cloud, Linux hosts, or containers
- Threat intelligence, threat hunting, or security research experience
- Bug bounty program or coordinated vulnerability disclosure experience
- Detection-as-code practices and detection rule writing
- Experience in fast-paced, cloud-native, or AI/ML-driven environments
- Relevant certifications (GCIH, GCFA, GCFR) or equivalent hands-on experience
