Incident Response Engineer

This is a fully remote position, open to applicants in California.

📋 Description

• Become a vital member of a high-impact security team focused on enhancing security at Snowflake.

• Implement, direct, and optimize autonomous AI agents for initial triage, context collection, and swift investigations.

• Manage escalations and lead comprehensive security investigations.

• Function as the Incident Commander during critical incidents.

• Develop scripts, automation pipelines, and agentic workflows to enhance incident response processes.

• Collaborate with teams in Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data.

• Design and enhance detection methods, threat signatures, and protective measures for both traditional and AI-based attack vectors.

• Engage in a regular on-call rotation.

• Convert incident insights and root-cause analyses into tactical solutions and long-term security engineering goals.

• Transform lessons learned from incidents into sustainable advancements in Snowflake’s security protocols.

⛳️ Requirements

• Minimum of 2 years of pertinent experience in incident response or security operations is preferred.

• Extensive experience in incident response, conducting security investigations, and managing incidents as the Incident Commander.

• Advanced proficiency with EDR, SIEM, SOAR, and DLP tools across endpoints, identity providers, SaaS, and cloud environments.

• In-depth knowledge of AI/LLM tools, security copilots, and AI-driven telemetry.

• Understanding of securing cutting-edge AI infrastructure, encompassing model training, serving pipelines, and AI agent permissions.

• Demonstrated capacity to identify and respond to contemporary AI-driven threats.

• Strong proficiency in Python programming.

• Expert-level comprehension of cloud security architectures (AWS, GCP, or Azure).

• Experience with container runtime isolation technologies (Docker, Kubernetes).

• Capability to translate incident insights and root-cause analyses into tactical solutions and long-term security engineering initiatives.

• Ability to conduct static and dynamic malware analysis utilizing sandbox environments and AI-enhanced reverse engineering tools.

• Experience in threat hunting or detection-as-code initiatives.

• Background in conducting sensitive investigations alongside Legal and HR departments.

• Familiarity with large-scale data platforms and security telemetry analysis.

• Contributions to open-source security tools, detection rules, or the broader security community are valued.

• Industry certifications such as GCIH, GCFA, or GREM are advantageous.

• Willingness to participate in a periodic on-call rotation, including non-standard working hours.

🏝️ Benefits

• Medical insurance

• Dental insurance

• Vision insurance

• Life insurance

• Disability insurance

• 401(k) retirement plan

• Flexible spending account

• Health savings account

• At least 12 paid holidays

• Paid time off

• Parental leave

• Employee assistance program

• Eligibility for bonus plans

• Eligibility for equity plans