Security Incident Response Engineer

Twitch•Irvine, CA

2d•Hybrid

About The Position

Twitch is looking for a Security Incident Response Engineer to join their Security Incident Response Team (SIRT). This role is central to the mission of finding, handling, and learning from security incidents across Twitch's global platform. The ideal candidate will be an engineer who thrives in coordinating responses to emerging information security issues and is ready to enhance the company's defenses. The position is based in San Francisco, CA; Irvine, CA; or Seattle, WA.

Requirements

3+ years of relevant experience in information security work or equivalent.
BS degree in Information Security, Information Systems, Computer Science, Computer Engineering, or other related fields.
Automation experience using scripting or programming languages (Go, Python, Ruby, Shell, or Perl).
Ability to securely design and implement AI/ML-driven playbooks to automate common security operations.
Experience coordinating responses to security incidents.
Knowledge of security issues and threat landscape.
Background in cloud, host, network, and application security.
Familiarity with common Incident Response frameworks or lifecycle models like NIST-800-61, ISO/IEC 27035, etc.

Nice To Haves

B.S. or M.S. in Computer Science, Computer Engineering, Software Security, or a related technical discipline.
Experience and familiarity with streaming and content creation.
Experience handling security incidents in a hybrid cloud environment (AWS, GCP) and conducting log dives on cloud telemetry like CloudTrail.
Passion and excitement for Twitch.

Responsibilities

Participate in an on-call rotation with peers on the Security Incident Response Team.
Qualify reports or alerts of activity as security incidents using clear guidelines.
Evaluate the potential and realized impact of security incidents to Twitch.
Analyze threat actor tactics, techniques, and procedures.
Participate in or create information sharing groups; communicate securely and responsibly.
Write and follow clear procedures for accountability, repeatability, measurement, and improvement.
Communicate with peers and leadership about the timeline of a security-related event, its potential and realized impact, discovery method, and handling.
Coordinate security incident response activities with affected teams to ensure the best outcome for customers and the organization.
Investigate, document, and implement agentic detection, enrichment, triage, response, and communication automations in daily processes.
Lead lessons learned discussions and help teams effect change across the business to reduce incident recurrence.

Benefits

Medical, Dental, Vision & Disability Insurance
401(k)
Maternity & Parental Leave
Flexible PTO
Amazon Employee Discount
Sign-on payments
Restricted stock units (RSUs)
Health insurance (medical, dental, vision, prescription, Basic Life & AD&D insurance and option for Supplemental life plans, EAP, Mental Health Support, Medical Advice Line, Flexible Spending Accounts, Adoption and Surrogacy Reimbursement coverage)
401(k) matching
Paid time off
Parental leave