Incident Response Engineer
Snowflake · Remote · US-CA-Bay Area-Remote ·
COMPENSATION
$143k – $206k
Listed on the employer's job board (Ashby)
- Fully remote
- Security + AI Agents
- Python automation
- Cloud security focus
- Incident Commander
Join Snowflake's Incident Response team to redefine security operations by pairing human judgment with autonomous AI agents. You will detect, investigate, and contain threats across a growing cloud and AI footprint, acting as an Incident Commander for critical events.
The position requires building scripts and agentic workflows to enhance response capabilities while collaborating with Threat Detection, Product Security, and Legal teams. You will help secure frontier AI infrastructure and develop defenses against modern AI-driven attacks.
What you'll do
- Spearhead agentic incident response by deploying and refining autonomous AI agents
- Act as Incident Commander for critical security incidents and escalations
- Build scripts and automation pipelines to enhance incident response capabilities
- Create and improve detections and guardrails for traditional and AI-driven attacks
- Partner with Threat Detection, Legal, HR, and Cloud teams on investigations
- Participate in periodic on-call rotation with potential non-traditional hours
What you'll need
- At least 2 years of experience in incident response or security operations
- Strong background in running incidents as Incident Commander
- Advanced experience with EDR, SIEM, SOAR, and DLP tools
- Deep familiarity with AI/LLM tooling and security copilots
- Proficiency in Python for building automated orchestration pipelines
- Expert understanding of AWS, GCP, or Azure security architectures
- Knowledge of container runtime isolation using Docker and Kubernetes
- Ability to perform static and dynamic malware analysis
Nice to have
- Experience with threat hunting or detection-as-code programs
- Background in sensitive investigations involving Legal and HR
- Familiarity with large-scale data platforms for telemetry analysis
- Contributions to open-source security tooling or community
- Holdings of industry certifications like GCIH, GCFA, or GREM
Stack
- Python
- AWS
- GCP
- Azure
- Docker
- Kubernetes
- EDR
- SIEM
- SOAR
- DLP
How you'll work
- Includes periodic on-call rotation
- May involve non-traditional working hours