Security Engineer - Incident Response

Role

Replit is hiring a Security Engineer focused on Incident Response to lead investigations from first signal to root cause, coordinate containment across Security, SRE, and Engineering, and improve detection and automation to reduce time-to-contain. The role balances hands-on incident response with building scripts, tooling, and playbooks that automate triage, evidence collection, and containment.

Key Responsibilities

Incident Response

• Serve as incident commander or technical lead for security incidents (detection, triage, containment, eradication, recovery, post-incident review).
• Coordinate response across Security, SRE, Engineering, Legal, and leadership; drive decisions under pressure and maintain clear records.
• Communicate status and impact to technical and executive audiences.
• Participate in and shape the security on-call rotation.

Investigation & Forensics

• Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers using SIEM, cloud logs, telemetry, and host/container artifacts.
• Determine scope, root cause, attacker behavior, and blast radius.
• Rapidly assess applicability of emerging threats (0-days, exploitation campaigns, bug bounty findings, customer reports).

IR Automation & Tooling

• Build scripts, automations, and tools (Python, Go, Bash, or directly on Replit) for enrichment, evidence collection, credential/session revocation, workload isolation, and alert triage.
• Develop and maintain response playbooks and runbooks and automate them where possible.
• Integrate response workflows with SIEM, SOAR, ticketing, and chat tooling to reduce time-to-contain.

Detection & Continuous Improvement

• Convert incident findings into improved detections, logging coverage, and visibility.
• Lead blameless post-incident reviews and drive remediation items to completion.
• Run tabletop exercises and simulations to test readiness and find gaps.

Requirements

• Proven experience leading or serving as technical lead on security incidents in cloud or SaaS environments.
• Strong hands-on investigation skills with SIEM, cloud audit logs, and log-based analysis; able to work with large datasets under time pressure.
• Proficiency writing production-quality scripts/tools in Python, Go, or Bash for investigation and automation.
• Solid knowledge of cloud architecture and security, especially Google Cloud Platform (IAM, audit logging, GKE, networking).
• Working knowledge of Kubernetes and containers, including investigation and containment of compromised workloads.
• Understanding of identity systems, SaaS architectures, and common cloud attack paths (credential theft, privilege escalation, supply chain, token abuse).
• Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems.
• Understanding of IR frameworks and lifecycle (for example NIST 800-61) and vulnerability lifecycle/exploitability analysis.

Preferred Qualifications

• Experience building or operating SOAR or other response automation platforms.
• Digital forensics experience with cloud, Linux hosts, or containers.
• Experience with threat intelligence, threat hunting, or security research.
• Experience with bug bounty programs or coordinated vulnerability disclosure.
• Familiarity with detection-as-code practices and writing detection rules.
• Experience in fast-paced, cloud-native, or AI/ML-driven environments.
• Relevant certifications (e.g., GCIH, GCFA, GCFR) or equivalent hands-on experience.

Benefits

• Competitive salary and equity
• 401(k) program with 4% match (US only)
• Health, dental, vision, and life insurance
• Short term and long term disability
• Paid parental, medical, and caregiver leave
• Flexible Time Off (FTO) and holidays
• Commuter benefits (in-office & US only)
• Monthly wellness stipend
• Autonomous work environment
• In-office setup reimbursement and amenities (in-office only)
• Quarterly team gatherings