The opportunity
We're looking for a Security Engineer with deep incident response experience to help defend Replit, a fast-moving, cloud-native AI vibe-coding platform. You'll be the person who takes charge when something goes wrong.
What you'll do
Serve as incident commander or technical lead for security incidents, from: detection and triage through containment, eradication, recovery, and post-incident review.
Coordinate response across Security, SRE, Engineering, Legal, and leadership.: Drive decisions under pressure and keep a clear record of actions taken.
Communicate incident status, impact, and risk clearly to technical and executive audiences.
Participate in and help shape the security on-call rotation.
Investigate suspicious activity across cloud infrastructure, containers,: identity systems, and application layers using SIEM, Cloud Logging, telemetry, and host and container artifacts.
Determine scope, root cause, attacker behavior, and blast radius for confirmed incidents.
What they're looking for
- Experience building or operating SOAR or other response automation platforms.
- Digital forensics experience with cloud, Linux hosts, or containers.
- Experience with threat intelligence, threat hunting, or security research.
- Experience with bug bounty programs or coordinated vulnerability disclosure.
- Familiarity with detection-as-code practices and writing detection rules.
- Experience in fast-paced, cloud-native, or AI/ML-driven environments.
- Relevant certifications (such as GCIH, GCFA, GCFR), or equivalent hands-on experience.
