Engineering Manager, Security – Cloud, Infrastructure & Application Security

Replit

. Lead teams securing Replit's cloud, infrastructure, and shipped code .

Posted 11/10/2026full-timeFoster City • California • United StatesSeniorLead💰 $250,000 - $387,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive expertise in cloud security, vulnerability management, and Secure SDLC, with a proven ability to lead teams and drive remediation efforts across diverse engineering environments. Proficient in managing security programs, incident response, and communicating risk effectively to stakeholders.

Highest-signal resume keywords

Cloud Security ExpertiseVulnerability Management ProgramsSecure SDLC DevelopmentCSPM/CNAPP Tooling ExperienceLeadership in Security Engineering

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Cloud SecurityVulnerability ManagementSecure SDLCInfrastructure-as-CodeKubernetes SecurityPython ProgrammingGo ProgrammingTypeScript ProgrammingSCA ToolsSAST Tools

Soft Skills

Excellent CommunicationInfluencing Engineering Leaders

Tools & Technologies

GCPAWSAzureCSPM ToolsCI/CD IntegrationSecurity Command CenterWizOrcaPrisma CloudLacework

Certifications & Qualifications

CCSPGCP Professional Cloud Security EngineerOSCPCSSLP

Industry Keywords

SOC 2ISO 27001PCI DSSFedRAMPCISNISTSecurity Incident ResponseSoftware Supply Chain SecuritySBOM StandardsSecurity Champions Program

Tech Stack

Tools & technologies

AWSAzureCloudGoogle Cloud PlatformKubernetesPythonSDLCTerraformTypeScriptGo

About the role

Key responsibilities & impact

Lead teams securing Replit's cloud, infrastructure, and shipped code
Drive remediation of cloud, infrastructure, and application vulnerabilities within SLA
Hire, mentor, and manage security engineers; own career development and performance management
Define multi-year roadmaps and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC
Establish ownership, operating rhythms, on-call, and escalation processes
Report security posture, risk trends, and program metrics to engineering and executive leadership
Own remediation SLAs, exception and risk-acceptance processes, and automated finding workflows
Partner with engineering leaders to prioritize and land fixes within SLA
Produce audit-ready remediation evidence and lead vulnerability-management audit activities
Lead infrastructure vulnerability management across cloud workloads, containers, registries, data stores, and platform services
Oversee secure baselines and configuration hardening across GCP, AWS, and Azure
Own CSPM, KSPM, and DSPM tooling strategy
Secure critical SaaS platforms and partner on multi-tenant and AI infrastructure security
Own SCA, SAST, and IaC scanning programs, including tool selection, CI/CD integration, rule tuning, and noise reduction
Drive software supply-chain security, including dependency management, SBOMs, artifact signing, and SLSA progress
Define and run the Secure SDLC program, including threat modeling, secure design reviews, and risk-based release gates
Deliver onboarding and role-based security training and grow a Security Champions network
Support incident response with asset, exposure, vulnerability, and blast-radius context
Own remediation follow-up from incidents and postmortems
Collaborate with Security Monitoring/Detection, Incident Response, Offensive Security, PSIRT, Architecture, DevOps, and Platform Engineering
Communicate security advisories and best practices to customers
Respond to threat intelligence alerts and manage patching of critical exploitable vulnerabilities

Requirements

What you’ll need

8+ years in security engineering, cloud security, or DevSecOps, including 2+ years managing security engineers (or 3+ years as a tech lead with formal people-leadership responsibility)
Deep, hands-on knowledge of cloud security in GCP plus working knowledge of AWS and/or Azure: IAM, networking, logging, org policies, and security services
Proven track record running vulnerability management programs at scale and driving remediation across many engineering teams to meet SLAs, across cloud infrastructure, containers, and application code
Hands-on experience with CSPM/CNAPP platforms, such as Wiz, Orca, Prisma Cloud, Lacework, or GCP Security Command Center
Hands-on experience with SCA, SAST, and IaC scanning tools and integrating them into CI/CD
Strong understanding of Kubernetes and container security, and Infrastructure-as-Code (Terraform or similar)
Proven track record of building or maturing a Secure SDLC program, including developer security training
Ability to write and review code or automation (Python, Go, TypeScript, or similar)
Strong understanding of remediation SLAs and security controls mapped to SOC 2, ISO 27001, PCI DSS, FedRAMP, CIS, and NIST, with experience producing audit evidence
Working understanding of security incident response in cloud-native environments
Excellent communication skills, with the ability to influence engineering leaders and explain risk in business terms
Experience securing developer platforms, multi-tenant SaaS, or AI/ML infrastructure
Experience with software supply chain frameworks, including SLSA, Sigstore, and SBOM standards
Experience building a Security Champions program or developer-facing security tooling
Experience leading the security side of external audits
Relevant certifications such as CCSP, GCP Professional Cloud Security Engineer, OSCP, or CSSLP are a bonus, not required
Ability to work from the Foster City, CA HQ 3 days per week
Legally authorized to work in the United States

Benefits

Comp & perks

Competitive Salary & Equity
401(k) Program with a 4% match (US Only)
Health, Dental, Vision and Life Insurance
Short Term and Long Term Disability
Paid Parental, Medical, Caregiver Leave
Flexible Time Off (FTO) + Holidays
Commuter Benefits (In-Office & US Only)
Monthly Wellness Stipend
Autonomous Work Environment
In Office Set-Up Reimbursement (In-Office Only)
Quarterly Team Gatherings
In Office Amenities (In-Office Only)