Security Engineer – Incident Response

Replit

. Serve as incident commander or technical lead for security incidents from detection and triage through containment, eradication, recovery, and post-incident review .

Posted 10/5/2026full-timeFoster City • California • United StatesMid-LevelSenior💰 $230,000 - $360,000 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in incident response and security incident management, with strong capabilities in cloud security, scripting, and automation. Proficient in leading investigations and coordinating cross-functional teams to enhance security posture and incident readiness.

Highest-signal resume keywords

Incident Response LeadershipCloud Security ExpertiseScripting in Python, Go, BashSIEM and Log AnalysisDigital Forensics Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident CommandInvestigation SkillsCloud Architecture KnowledgeKubernetes and Container ManagementIR Frameworks UnderstandingThreat IntelligenceDetection-as-Code PracticesAutomation Platform OperationVulnerability Lifecycle AnalysisProduction-Quality Scripting

Soft Skills

Decision-Making Under PressureEffective CommunicationCollaboration Across TeamsAdaptability in Fast-Paced Environments

Tools & Technologies

SIEMCloud LoggingSOARTelemetryTicketing SystemsChat ToolingGoogle Cloud PlatformCI/CD Pipelines

Certifications & Qualifications

GCIHGCFAGCFR

Industry Keywords

Cloud SecuritySaaS EnvironmentIncident ResponseDigital ForensicsThreat Hunting

Tech Stack

Tools & technologies

CloudGoogle Cloud PlatformKubernetesLinuxPythonGo

About the role

Key responsibilities & impact

Serve as incident commander or technical lead for security incidents from detection and triage through containment, eradication, recovery, and post-incident review
Coordinate response across Security, SRE, Engineering, Legal, and leadership
Drive decisions under pressure and maintain a clear record of actions taken
Communicate incident status, impact, and risk to technical and executive audiences
Participate in and help shape the security on-call rotation
Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers
Use SIEM, Cloud Logging, telemetry, and host and container artifacts for investigations
Determine scope, root cause, attacker behavior, and blast radius for confirmed incidents
Assess whether emerging threats apply to Replit and whether the company is already affected
Build scripts, automations, and tools in Python, Go, Bash, or directly on Replit to accelerate response
Automate enrichment, evidence collection, credential and session revocation, workload isolation, and alert triage
Develop and maintain response playbooks and runbooks
Integrate response workflows with SIEM, SOAR, ticketing, and chat tooling
Turn incident findings into improved detections, logging coverage, and visibility
Lead blameless post-incident reviews and drive remediation items to completion
Run tabletop exercises and simulations to test readiness and identify gaps

Requirements

What you’ll need

Proven experience leading or serving as technical lead on security incidents in a cloud or SaaS environment
Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis
Comfortable working through large datasets under time pressure
Proficiency writing production-quality scripts or tools in Python, Go, or Bash
Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking)
Working knowledge of Kubernetes and containers, including how to investigate and contain compromised workloads
Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse)
Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems
Understanding of IR frameworks and lifecycle (for example NIST 800-61), plus the vulnerability lifecycle and exploitability analysis
Experience building or operating SOAR or other response automation platforms
Digital forensics experience with cloud, Linux hosts, or containers
Experience with threat intelligence, threat hunting, or security research
Experience with bug bounty programs or coordinated vulnerability disclosure
Familiarity with detection-as-code practices and writing detection rules
Experience in fast-paced, cloud-native, or AI/ML-driven environments
Relevant certifications such as GCIH, GCFA, or GCFR, or equivalent hands-on experience

Benefits

Comp & perks

Competitive Salary & Equity
401(k) Program with a 4% match (US Only)
Health, Dental, Vision and Life Insurance
Short Term and Long Term Disability
Paid Parental, Medical, Caregiver Leave
Flexible Time Off (FTO) + Holidays
Commuter Benefits (In-Office & US Only)
Monthly Wellness Stipend
Autonomous Work Environment
In Office Set-Up Reimbursement (In-Office Only)
Quarterly Team Gatherings
In Office Amenities (In-Office Only)