Engineering Manager, Security (Cloud, Infrastructure & Application Security)

Replit•Foster City, CA

3d•$250,000 - $387,000

About The Position

Replit is seeking an Engineering Manager, Security to lead teams responsible for cloud, infrastructure, and application security. The role manages Cloud & Infrastructure Security and Application Security & Secure SDLC groups, and focuses on timely remediation of vulnerabilities across cloud, infrastructure, containers, and code. The manager will partner with engineering teams to meet remediation SLAs and compliance commitments, hire and develop a high-performing team, set strategy and roadmaps for vulnerability management from code to cloud, and make secure-by-default practices easy for developers. The role does not own incident response, but partners with the incident response team by providing context, prioritization, and follow-up remediation. The manager will lead team strategy and operations, define multi-year roadmaps and quarterly OKRs, establish ownership and escalation processes, and report security posture and program metrics to leadership. The role owns remediation workflows, exception and risk-acceptance processes, audit-ready evidence, and external audit support for vulnerability management controls. Responsibilities span cloud security across GCP, AWS, and Azure; vulnerability management for workloads, containers, registries, data stores, and platform services; configuration hardening; cloud, Kubernetes, and data security posture management; SaaS security; and collaboration on multi-tenant and AI infrastructure. The role also owns SCA, SAST, and IaC scanning programs, software supply chain security, Secure SDLC practices, developer training, secure defaults, and a Security Champions network. It partners with incident response, detection, offensive security, PSIRT, architecture, DevOps, and platform teams, and follows threat intelligence to support timely patching.

Requirements

At least 8 years of experience in security engineering, cloud security, or DevSecOps.
At least 2 years managing security engineers, or at least 3 years as a tech lead with formal people-leadership responsibility.
Deep hands-on knowledge of GCP cloud security and working knowledge of AWS and/or Azure, including IAM, networking, logging, organization policies, and security services.
Proven experience operating vulnerability management programs at scale and driving remediation across many engineering teams to meet SLAs for cloud infrastructure, containers, and application code.
Hands-on experience with CSPM/CNAPP platforms such as Wiz, Orca, Prisma Cloud, Lacework, or GCP Security Command Center.
Hands-on experience with SCA, SAST, and IaC scanning tools and integrating them into CI/CD.
Strong understanding of Kubernetes and container security, and Infrastructure-as-Code such as Terraform.
Proven experience building or maturing a Secure SDLC program, including developer security training.
Ability to write and review code or automation in Python, Go, TypeScript, or similar.
Strong understanding of how remediation SLAs and security controls map to compliance frameworks, including SOC 2, ISO 27001, PCI DSS, FedRAMP, CIS, and NIST, and experience producing audit evidence.
Working understanding of security incident response in cloud-native environments sufficient to partner effectively with incident response and detection teams.
Excellent communication skills and ability to influence engineering leaders and explain risk in business terms.

Nice To Haves

Experience securing developer platforms, multi-tenant SaaS, or AI/ML infrastructure.
Experience with software supply chain frameworks such as SLSA, Sigstore, and SBOM standards.
Experience building a Security Champions program or developer-facing security tooling.
Experience leading the security side of external audits such as SOC 2 Type II, ISO 27001, PCI DSS, or FedRAMP.
Relevant certifications such as CCSP, GCP Professional Cloud Security Engineer, OSCP, or CSSLP.

Responsibilities

Build, lead, and mentor cloud security, infrastructure vulnerability management, and application security engineers; own hiring, career development, and performance management.
Define multi-year roadmaps and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC.
Set team ownership, operating rhythms, and on-call and escalation processes.
Report security posture, risk trends, and program metrics to engineering and executive leadership.
Own remediation SLAs across cloud, infrastructure, containers, and code findings, aligning them with compliance obligations and customer contracts.
Partner with engineering managers and technical leads to prioritize and deliver remediation within SLAs.
Run remediation reviews covering findings, SLA burn-down, potential breaches, and ownership.
Manage documented exceptions and risk acceptances, including compensating controls, expiry dates, and approvals.
Build automated workflows to route findings to owning teams, track closure, and escalate before SLA breaches.
Work with Compliance/GRC to provide audit-ready evidence and lead the security side of external audits for vulnerability management controls.
Track and report SLA attainment, mean time to remediate, backlog age, and exceptions by team and severity.
Lead infrastructure vulnerability management for cloud workloads, containers, registries, data stores, and platform services.
Oversee configuration hardening and secure baselines across GCP and supporting AWS and Azure environments.
Own CSPM, KSPM, and DSPM tooling strategy and ensure findings are accurate, prioritized, and actionable.
Secure critical SaaS platforms through sound configurations, access controls, and integrations.
Partner with Platform and ML Infrastructure teams to secure multi-tenant and AI infrastructure.
Own SCA, SAST, and IaC scanning programs, including tool selection, CI/CD integration, rule tuning, noise reduction, and developer experience.
Drive software supply chain security, including dependency management, SBOMs, artifact signing, and progress through SLSA levels.
Integrate code-scanning findings into central remediation workflows and track them against SLAs.
Shift IaC security left so misconfigurations are caught in pull requests before production.
Define and run the Secure SDLC program, including security requirements, threat modeling, secure design reviews, and risk-proportionate release gates.
Develop and deliver onboarding, role-based secure coding, and vulnerability-trend-based security training.
Develop secure defaults, paved roads, and guardrails that make secure development easier.
Grow a Security Champions network across engineering teams.
Support incident response with asset, exposure, and vulnerability context and help assess blast radius.
Own and track to closure follow-up remediation from incidents and postmortems affecting cloud, infrastructure, or code.
Feed incident learnings into scanning rules, secure baselines, and developer training.
Collaborate with Security Monitoring/Detection, Incident Response, Offensive Security, PSIRT, Architecture, DevOps, and Platform Engineering.
Help communicate security advisories, best practices, and updates to customers.
Monitor threat intelligence alerts and manage patching of critical, exploitable vulnerabilities.