Security Incident Response Engineer

Twitch•San Francisco, CA

3d•$159,300 - $212,800•Hybrid

About The Position

Twitch is looking for a Security Incident Response Engineer to join their Security Incident Response Team (SIRT). This role is central to the mission of identifying, managing, and learning from security incidents across Twitch's global platform. The ideal candidate will be skilled in coordinating responses to emerging information security issues and enhancing the company's defenses. This position is based in San Francisco, CA; Irvine, CA; or Seattle, WA.

Requirements

3+ years of relevant experience in information security or an equivalent BS degree in Information Security, Information Systems, Computer Science, Computer Engineering, or a related field.
Automation experience using scripting or programming languages (Go, Python, Ruby, Shell, or Perl).
Ability to securely design and implement AI/ML-driven playbooks to automate common security operations.
Experience coordinating responses to security incidents.
Knowledge of security issues and the threat landscape.
Background in cloud, host, network, and application security.
Familiarity with common Incident Response frameworks or lifecycle models like NIST-800-61, ISO/IEC 27035, etc.

Nice To Haves

B.S. or M.S. in Computer Science, Computer Engineering, Software Security, or a related technical discipline.
Experience and familiarity with streaming and content creation.
Experience handling security incidents in a hybrid cloud environment (AWS, GCP) and conducting log dives on cloud telemetry like CloudTrail.
Passion and excitement for Twitch.

Responsibilities

Participate in an on-call rotation with the Security Incident Response Team.
Qualify reports or alerts of activity as security incidents using clear guidelines.
Evaluate the potential and realized impact of security incidents to Twitch.
Analyze threat actor tactics, techniques, and procedures.
Participate in or create information sharing groups; communicate securely and responsibly.
Write and follow clear procedures for accountability, repeatability, measurement, and improvement.
Communicate with peers and leadership about the timeline of a security-related event, its potential and realized impact, discovery method, and handling.
Coordinate security incident response activities with affected teams to protect customers and the organization.
Investigate, document, and implement automations for detection, enrichment, triage, response, and communication in daily processes.
Lead lessons learned discussions and facilitate change across the business to reduce incident recurrence.

Benefits

Medical, Dental, Vision & Disability Insurance
401(k)
Maternity & Parental Leave
Flexible PTO
Amazon Employee Discount
Sign-on payments
Restricted stock units (RSUs)
Health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage)
401(k) matching
Paid time off
Parental leave