SOC Engineer
About The Position
Replit is seeking a SOC Engineer to join its Security Operations team and help defend its cloud-native AI software creation platform. The role focuses on building and evolving the security data lake, engineering reliable security telemetry, and owning high-fidelity detection engineering from end to end. The engineer will unify cloud, identity, endpoint, and application telemetry; monitor emerging threats; and develop and tune detections across the environment. The role also supports incident investigations and uses findings to strengthen automated defenses. It is a hands-on engineering position requiring technical depth, knowledge of modern software engineering and CI/CD, familiarity with cloud-native infrastructure—especially GCP—and expertise in security data pipelines and detection workflows.
Requirements
- Hands-on experience building and evolving a security data lake that unifies cloud, identity, endpoint, and application telemetry.
- Hands-on experience with SIEM, Cloud Logging, and log-based investigation workflows.
- Experience engineering reliable security infrastructure and automation using infrastructure-as-code.
- Proven end-to-end detection engineering expertise, including developing, testing, and tuning custom detection rules to maximize threat coverage and reduce noise.
- Strong understanding of software engineering fundamentals, including code structure, build systems, dependencies, and package ecosystems.
- Understanding of CI/CD pipelines and DevOps workflows.
- Solid knowledge of cloud architecture, especially Google Cloud Platform (GCP) services in modern cloud-native deployments.
- Familiarity with SaaS architectures, identity systems, and integration patterns.
Nice To Haves
- Experience with threat intelligence, security research, or vulnerability analysis.
- Familiarity with Kubernetes, containers, serverless infrastructure, or modern distributed systems.
- Ability to write scripts or small tools for investigation or automation using Python, Go, or Bash.
- Experience with bug bounty programs or coordinated vulnerability disclosure workflows.
- Experience in fast-paced, cloud-native, or AI/ML-driven environments.
Responsibilities
- Architect, expand, and maintain the security data lake.
- Design, test, and tune custom detection rules to increase threat coverage and minimize noise across the cloud-native stack.
- Monitor emerging threats, including zero-days, malicious actor activity, public exploitation campaigns, bug bounty reports, and customer security issues.
- Rapidly assess emerging threats for their relevance to Replit's infrastructure, SaaS services, internal tools, and platform components.
- Conduct targeted investigations to determine impact by analyzing logs, telemetry, and system behavior using SIEM, metrics, and Cloud Logging.
- Identify gaps in detection and security visibility.
- Engineer reliable security infrastructure and automation using infrastructure-as-code to close visibility gaps.
- Support incident investigations and translate real-world threats into stronger automated defenses.
Benefits
- Competitive salary and equity.
- 401(k) program with a 4% match (US only).
- Health, dental, vision, and life insurance.
- Short-term and long-term disability coverage.
- Paid parental, medical, and caregiver leave.
- Flexible Time Off (FTO) and holidays.
- Commuter benefits (in-office and US only).
- Monthly wellness stipend.
- Autonomous work environment.
- In-office setup reimbursement (in-office only).
- Quarterly team gatherings.
- In-office amenities (in-office only).
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Education Level
No Education Listed
