Incident Response Engineer

Overview

Security Incident Response Engineer on Snowflake's Incident Response team, pairing autonomous AI agents with human judgment to detect, investigate, and contain threats across a growing cloud and AI footprint.

What you'll do

• Deploy, guide, and refine autonomous AI agents that execute initial triage, context gathering, and rapid investigation alongside human Incident Commanders
• Handle escalations, lead security investigations, and act as Incident Commander for critical incidents
• Build scripts, automation pipelines, and agentic workflows that continuously enhance Snowflake's incident response capabilities
• Partner closely with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams
• Create and improve detections, threat signatures, and guardrails for both traditional and AI-driven attack vectors
• Participate in a periodic on-call rotation, which may involve non-traditional working hours

What you'll need

• Strong experience in incident response, security investigations, and running incidents as the Incident Commander
• Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads
• Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry to accelerate investigations, threat triage, and post-incident reporting
• Knowledge of securing frontier AI infrastructure, including model training and serving pipelines and AI agent permissions
• Proven ability to detect and respond to modern AI-driven attacks
• Proficiency in Python to build automated orchestration pipelines, reduce manual incident response toil, and programmatically enrich security alerts
• Expert-level understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes)
• Ability to translate incident findings and root-cause analysis into short-term tactical fixes and long-term security engineering objectives
• Ability to perform static and dynamic malware analysis using sandbox environments and modern AI-assisted reverse engineering tools

Nice to have

• 2+ years of relevant experience in incident response or security operations
• Experience with threat hunting or building detection-as-code programs
• Experience running sensitive investigations alongside Legal and HR, such as insider risk cases
• Familiarity with large-scale data platforms and using them to analyze security telemetry
• Contributions to open-source security tooling, detection rules, or the broader security community
• Industry certifications such as GCIH, GCFA, or GREM

Details

• Location: Bay Area, California, United States (remote)
• Periodic on-call rotation, which may involve non-traditional working hours