Engineering Manager, Security (Cloud, Infrastructure & Application Security)
Replit · Foster City, CA
About this role
## About Replit Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. ## About the Role — Engineering Manager, Security Replit is looking for an **Engineering Manager, Security** to lead teams that secure **our cloud, infrastructure, and the code we ship**. You will manage two closely linked groups: - **Cloud & Infrastructure Security**: engineers who own cloud security posture, configuration hardening, and infrastructure vulnerability management across **GCP, AWS, and Azure**, plus **containers, Kubernetes, and SaaS platforms**. - **Application Security & Secure SDLC**: engineers who run **SCA, SAST, and IaC scanning** programs, drive remediation with engineering teams, and deliver **secure development training**. **Core responsibility:** getting vulnerabilities fixed on time. You will partner with engineering teams across the company to drive remediation of cloud, infrastructure, and code findings within SLA—so Replit consistently meets compliance commitments including **SOC 2, ISO 27001, PCI DSS, FedRAMP**, and customer contracts. You will hire and grow a high-performing team, set the strategy and roadmap for vulnerability management from code to cloud, and make **secure-by-default** the easiest path for every developer. You will **not** run incident response yourself, but you must understand it well enough to support the incident response team with context, prioritization, and follow-up fixes. --- ## What You’ll Do ### Team Leadership & Strategy - Build, lead, and mentor a team of cloud security, infrastructure vulnerability management, and application security engineers; own hiring, career development, and performance management. - Define the multi-year roadmap and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC—balancing risk reduction against developer velocity. - Set clear ownership, operating rhythms, and on-call/escalation processes across the team. - Report on security posture, risk trends, and program metrics to engineering and executive leadership. ### Remediation & Compliance Delivery - Own remediation SLAs by severity across cloud, infrastructure, container, and code findings, mapping to **SOC 2, ISO 27001, PCI DSS, FedRAMP**, and customer contracts. - Partner with engineering managers and tech leads to plan, prioritize, and land fixes within SLA without stalling roadmaps. - Run regular remediation reviews with engineering leadership (open findings, SLA burn-down, upcoming SLA breaches, and owners). - Manage the exception and risk-acceptance process (justification, compensating controls, expiry dates, approvals). - Build automated workflows that route findings to the right owning team, track them to closure, and escalate before SLAs are breached. - Work with Compliance/GRC to produce audit-ready evidence of remediation timeliness; lead the security side of external audits for vulnerability management controls. - Track and report metrics such as SLA attainment, mean time to remediate, backlog age, and exceptions by team and severity. ### Cloud & Infrastructure Security - Lead infrastructure vulnerability management across cloud workloads, containers, registries, data stores, and platform services—from scanning and contextual risk triage to remediation workflows. - Oversee configuration hard
Listing freshness
CronJobs last confirmed this listing 44m ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.