Incident Response Engineer
Snowflake · US-CA-Bay Area-Remote
About this role
**Incident Response Engineer — Snowflake** At Snowflake, we’re powering the era of the agentic enterprise. We’re hiring a **Security Incident Response Engineer** to join our **Incident Response** team and help redefine how incidents are handled at scale—pairing **autonomous AI agents** with **human judgment** to detect, investigate, and contain threats faster across our rapidly growing cloud and AI footprint. --- ### What you’ll do - Join a high-impact team of security experts to scale security at one of the fastest-growing software companies. - Lead an **agentic approach to Incident Response** by deploying, guiding, and refining autonomous AI agents for initial triage, context gathering, and rapid investigation alongside Incident Commanders. - Handle escalations, lead security investigations, and act as **Incident Commander** for critical incidents. - Build scripts, automation pipelines, and agentic workflows that continuously enhance Snowflake’s incident response capabilities. - Partner with **Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data** teams. - Create and improve detections, threat signatures, and guardrails for both traditional and **AI-driven** attack vectors. - Participate in a periodic **on-call rotation** (may involve non-traditional working hours). --- ### What you bring - **2+ years** of relevant experience in incident response or security operations (preferred). - Strong experience in incident response, security investigations, and running incidents as **Incident Commander**. - Advanced experience with security stack capabilities (**EDR, SIEM, SOAR, DLP**) across endpoints, identity providers, SaaS, and cloud workloads. - Deep familiarity with **AI/LLM tooling**, security copilots, and AI-driven telemetry to accelerate investigations, threat triage, and post-incident reporting. - Knowledge of securing frontier AI infrastructure, including model training/serving pipelines and AI agent permissions. - Proven ability to detect and respond to modern AI-driven attacks. - Proficiency in **Python** to build automated orchestration pipelines, reduce manual toil, and enrich security alerts programmatically. - Expert understanding of cloud security architectures (**AWS, GCP, or Azure**) and container runtime isolation (**Docker, Kubernetes**). - Ability to translate incident findings and root-cause analysis into tactical fixes and long-term security engineering objectives. - Ability to perform static/dynamic malware analysis using sandbox environments and modern AI-assisted reverse engineering tools. --- ### Bonus points - Experience with threat hunting or building **detection-as-code** programs. - Experience running sensitive investigations alongside **Legal and HR** (e.g., insider risk cases). - Familiarity with large-scale data platforms for analyzing security telemetry. - Contributions to open-source security tooling, detection rules, or the broader security community. - Industry certifications such as **GCIH, GCFA, or GREM**. --- ### Why join the Incident Response team at Snowflake? Shape what incident response looks like in the **agentic era**. You’ll work on the front line defending a critical data platform, building AI-driven workflows that help experts respond with the speed and precision modern threats demand—seeing incidents end to end and turning learnings into lasting improvements. **Apply (US roles):** careers.snowflake.com (see the Snowflake Careers Site for salary and benefits i
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.