Incident Response Engineer

Snowflake

. Join Snowflake’s Incident Response team and help scale security at a fast-growing software company .

Posted 10/16/2026full-timeRemote • California • United StatesJuniorMid-Level💰 $143,000 - $205,800 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in incident response and security operations, with a strong focus on deploying AI-driven solutions and cloud security architectures. Proficient in translating incident findings into actionable security engineering objectives and improving detection capabilities.

Highest-signal resume keywords

Incident ResponseSecurity InvestigationsCloud Security ArchitecturesPython ProficiencyAI-Driven Telemetry

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Incident ResponseSecurity InvestigationsPythonMalware AnalysisThreat DetectionAutomation PipelinesAI/LLM ToolingCloud SecurityContainer Runtime IsolationStatic and Dynamic Analysis

Soft Skills

LeadershipCollaborationCommunication

Tools & Technologies

EDRSIEMSOARDLPDockerKubernetesAI-Assisted Reverse Engineering Tools

Certifications & Qualifications

GCIHGCFAGREM

Industry Keywords

Incident CommanderThreat SignaturesSecurity TelemetryData PlatformsAI-Driven Attacks

Tech Stack

Tools & technologies

AWSAzureCloudDockerGoogle Cloud PlatformKubernetesPython

About the role

Key responsibilities & impact

Join Snowflake’s Incident Response team and help scale security at a fast-growing software company
Deploy, guide, and refine autonomous AI agents for initial triage, context gathering, and rapid investigation
Handle escalations, lead security investigations, and act as Incident Commander for critical incidents
Build scripts, automation pipelines, and agentic workflows to improve incident response
Partner with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams
Create and improve detections, threat signatures, and guardrails for traditional and AI-driven attack vectors
Participate in a periodic on-call rotation, potentially involving non-traditional working hours
Translate incident findings and root-cause analysis into tactical fixes and long-term security engineering objectives

Requirements

What you’ll need

2+ years of relevant experience in incident response or security operations preferred
Strong experience in incident response, security investigations, and running incidents as the Incident Commander
Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads
Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry
Knowledge of securing frontier AI infrastructure, including model training and serving pipelines and AI agent permissions
Proven ability to detect and respond to modern AI-driven attacks
Proficiency in Python
Expert-level understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes)
Ability to translate incident findings and root-cause analysis into tactical fixes and long-term security engineering objectives
Ability to perform static and dynamic malware analysis using sandbox environments and AI-assisted reverse engineering tools
Experience with threat hunting or detection-as-code programs is a bonus
Experience running sensitive investigations alongside Legal and HR is a bonus
Familiarity with large-scale data platforms and security telemetry analysis is a bonus
Contributions to open-source security tooling or detection rules are a bonus
Industry certifications such as GCIH, GCFA, or GREM are a bonus
Must be authorized to work in the country to which you are applying