Incident Response Engineer

This is a fully remote position, open to applicants in California.

📋 Description

• Become a part of Snowflake’s Incident Response team and contribute to enhancing security at a rapidly expanding software company.

• Implement, guide, and enhance autonomous AI agents for initial triage, context collection, and swift investigation.

• Manage escalations, lead security investigations, and serve as the Incident Commander for critical incidents.

• Develop scripts, automation pipelines, and agentic workflows to enhance incident response capabilities.

• Collaborate with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams.

• Design and refine detections, threat signatures, and guardrails for both traditional and AI-driven attack vectors.

• Engage in a periodic on-call rotation, which may involve non-traditional working hours.

• Convert incident findings and root-cause analyses into tactical solutions and long-term security engineering goals.

⛳️ Requirements

• A minimum of 2 years of relevant experience in incident response or security operations is preferred.

• Significant experience in incident response, conducting security investigations, and acting as the Incident Commander.

• Advanced proficiency in utilizing security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads.

• Extensive knowledge of AI/LLM tools, security copilots, and AI-driven telemetry.

• Understanding of securing cutting-edge AI infrastructure, including model training and serving pipelines, as well as AI agent permissions.

• Demonstrated ability to identify and respond to contemporary AI-driven attacks.

• Proficient in Python.

• Expert understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes).

• Capability to translate incident findings and root-cause analyses into tactical solutions and long-term security engineering objectives.

• Competence in performing static and dynamic malware analysis using sandbox environments and AI-assisted reverse engineering tools.

• Experience with threat hunting or detection-as-code initiatives is an advantage.

• Familiarity with conducting sensitive investigations alongside Legal and HR is a plus.

• Knowledge of large-scale data platforms and security telemetry analysis is beneficial.

• Contributions to open-source security tools or detection rules are a plus.

• Industry certifications such as GCIH, GCFA, or GREM are advantageous.

• Must have authorization to work in the country where you are applying.

🏝️ Benefits

• Opportunity to work in a dynamic and innovative environment.

• Competitive salary and comprehensive benefits package.

• Professional development opportunities to enhance your skills.

• Flexible working hours and remote work options.