Incident Response Engineer

Snowflake • Remote, CA

1d • $143,000 - $205,800

About The Position

Snowflake is hiring a Security Incident Response Engineer to join its Incident Response team. The role focuses on handling security incidents at scale by combining autonomous AI agents with human judgment to detect, investigate, and contain threats across Snowflake’s cloud and AI footprint. The engineer will work with security experts and cross-functional teams to improve incident response capabilities and defend Snowflake’s data platform.

Requirements

• 2+ years of relevant experience in incident response or security operations preferred.
• Strong experience in incident response, security investigations, and running incidents as Incident Commander.
• Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads.
• Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry to accelerate investigations, threat triage, and post-incident reporting.
• Knowledge of securing frontier AI infrastructure, including model training and serving pipelines and AI agent permissions.
• Proven ability to detect and respond to modern AI-driven attacks.
• Proficiency in Python to build automated orchestration pipelines, reduce manual incident response toil, and programmatically enrich security alerts.
• Expert-level understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes).
• Ability to translate incident findings and root-cause analysis into short-term tactical fixes and long-term security engineering objectives.
• Ability to perform static and dynamic malware analysis using sandbox environments and modern AI-assisted reverse engineering tools.

Nice To Haves

• Experience with threat hunting or building detection-as-code programs.
• Experience running sensitive investigations alongside Legal and HR, such as insider risk cases.
• Familiarity with large-scale data platforms and using them to analyze security telemetry.
• Contributions to open-source security tooling, detection rules, or the broader security community.
• Industry certifications such as GCIH, GCFA, or GREM.

Responsibilities

• Help scale security at Snowflake as part of a team of security experts.
• Deploy, guide, and refine autonomous AI agents for initial triage, context gathering, and rapid investigation alongside human Incident Commanders.
• Handle escalations, lead security investigations, and act as Incident Commander for critical incidents.
• Build scripts, automation pipelines, and agentic workflows to improve incident response capabilities.
• Partner with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams.
• Create and improve detections, threat signatures, and guardrails for traditional and AI-driven attack vectors.
• Participate in a periodic on-call rotation, which may involve non-traditional working hours.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed