Security Engineer (Incident Response)

Join Replit, a fast-moving, cloud-native AI vibe-coding platform, as a Security Engineer specializing in Incident Response. In this role, you will lead investigations from the first signal to root cause, coordinate containment across various teams, and communicate incident status to stakeholders. You will also build scripts and tools to automate manual work and turn lessons from each incident into better detections and platform hardening. This is a remote-first position with flexible work hours and a range of benefits.

About Replit

• Continuous learning: Passion for staying up to date on new vulnerabilities, exploit trends, and cloud-native security best practices
• Curiosity & initiative: Strong desire to understand attacker behaviors, emerging threats, and how they apply to real-world systems

Responsibilities

• Assumer la responsabilité de la gestion des incidents de sécurité, de la détection à la récupération, en coordonnant les efforts entre les équipes de sécurité, d'ingénierie et de direction.
• Développer et maintenir des scripts, des automatisations et des outils pour améliorer l'efficacité de la réponse aux incidents, y compris l'enrichissement automatisé et la collecte de preuves.
• Participer à l'élaboration et à la mise en œuvre de plans de réponse aux incidents, en intégrant les flux de travail de réponse avec les outils de SIEM, de SOAR et de billetterie.
• Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking)
• Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse)
• Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems, so you can work effectively with Engineering on code-level fixes
• Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis. Comfortable working through large datasets under time pressure
• Understanding of IR frameworks and lifecycle (for example NIST 800-61), plus the vulnerability lifecycle and exploitability analysis
• Proven experience leading or serving as technical lead on security incidents in a cloud or SaaS environment

Requirements

• Working knowledge of Kubernetes and containers, including how to investigate and contain compromised workloads
• Proficiency writing production-quality scripts or tools in Python, Go, or Bash for investigation and automation
• Ownership mindset: Takes initiative to drive investigations, improvements, and remediations to completion
• Collaboration: Comfort working across cross-functional teams spanning Security, SRE, Engineering, and Infrastructure
• Clear communication: Ability to explain findings, risks, and mitigation strategies to stakeholders at all levels
• Speed & analytical rigor: Ability to quickly assess high-risk vulnerabilities with clear, evidence-based reasoning
• Experience building or operating SOAR or other response automation platforms
• Digital forensics experience with cloud, Linux hosts, or containers
• Experience in fast-paced, cloud-native, or AI/ML-driven environments

Preferred

• Experience with threat intelligence, threat hunting, or security research
• Experience with bug bounty programs or coordinated vulnerability disclosure
• Familiarity with detection-as-code practices and writing detection rules
• Relevant certifications (such as GCIH, GCFA, GCFR), or equivalent hands-on experience

Pay

USD 230,000 - 360,000