Based in Foster City, CA, the Security Engineer - Incident Response position at Replit involves managing threat investigations and automation within a cloud-native platform. This role suits professionals with deep incident response experience who want to build tooling and drive security readiness.
Role Overview
Replit is hiring a Security Engineer specializing in incident response to defend a cloud-native platform. The individual in this position will take charge during security events, lead root cause investigations, and coordinate containment efforts across multiple internal groups. Beyond active response, the engineer will author automation scripts and tooling to streamline triage and evidence collection, while transforming post-incident lessons into robust detections and playbooks.
Key Responsibilities
Act as incident commander or technical lead for security incidents through all stages, including detection, triage, containment, eradication, recovery, and post-incident reviews.
Coordinate the response across Security, SRE, Engineering, Legal, and leadership teams while keeping accurate records and driving pressure-tested decisions.
Communicate incident status, risk, and impact clearly to both technical personnel and executive leadership.
Participate in and help shape the security on-call rotation.
Investigate suspicious activity across cloud infrastructure, containers, identity systems, and application layers utilizing SIEM, Cloud Logging, and host artifacts.
Determine the scope, root cause, attacker behavior, and blast radius for confirmed incidents.
Assess emerging threats quickly to see if active exploitation campaigns, zero-days, or customer reports affect Replit.
Write scripts, automations, and tools using Python, Go, Bash, or directly on Replit to expedite triage, evidence collection, credential revocation, and workload isolation.
Build and maintain response playbooks and integrate workflows with ticketing, SIEM, SOAR, and chat tools.
Translate incident findings into improved logging coverage, detection rules, and visibility.
Lead blameless post-incident reviews and drive remediation items to completion, alongside running tabletop exercises.
Requirements
Proven experience leading or serving as technical lead on security incidents within a cloud or SaaS environment.
Strong investigative capabilities using SIEM, cloud audit logs, and log-based analysis under time constraints.
Proficiency in writing production-quality scripts or tools in Python, Go, or Bash.
Solid knowledge of cloud architecture and security, particularly Google Cloud Platform such as IAM, audit logging, GKE, and networking.
Working knowledge of Kubernetes and containers for investigating and containing compromised workloads.
Understanding of identity systems, SaaS architectures, and common cloud attack vectors like credential theft, privilege escalation, supply chain risks, and token abuse.
Familiarity with software engineering fundamentals, CI/CD pipelines, and package ecosystems to collaborate effectively on code-level fixes.
Understanding of incident response frameworks, the vulnerability lifecycle, and exploitability analysis.
Nice to Have
Experience building or operating SOAR or other response automation platforms.
Digital forensics background covering cloud environments, Linux hosts, or containers.
Experience in threat intelligence, security research, or threat hunting.
Background with bug bounty programs or coordinated vulnerability disclosure.
Familiarity with detection-as-code practices and custom detection rule authoring.
Previous work in fast-paced, cloud-native, or AI/ML-driven environments.
Relevant certifications such as GCIH, GCFA, GCFR, or equivalent hands-on experience.
Skills and Tools
Python
Go
Bash
Google Cloud Platform (GCP)
Kubernetes
GKE
SIEM
SOAR
Cloud Logging
Salary and Benefits
Competitive salary ranging from $230K to $360K plus equity
401(k) program with a 4% match for US employees
Health, dental, vision, and life insurance
Short-term and long-term disability coverage
Paid parental, medical, and caregiver leave
Flexible Time Off (FTO) alongside holidays
Commuter benefits for in-office and US staff
Monthly wellness stipend and autonomous work environment
In-office setup reimbursement, team gatherings, and office amenities
About the Company
Replit provides an agentic software creation platform designed to let users build applications using natural language. Serving millions of users globally, the company removes traditional barriers to application creation to democratize software development.
How to Apply
Interested candidates should apply directly on the official Replit careers page.
