Incident Response Engineer

The role

You will join the Incident Response team to redefine how incidents are handled at scale. You will deploy autonomous AI agents and lead security investigations to detect, investigate, and contain threats.

What you will do

• Deploy, guide, and refine autonomous AI agents for triage and investigation
• Handle escalations and lead security investigations
• Act as Incident Commander for critical incidents
• Build scripts, automation pipelines, and agentic workflows
• Partner with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams
• Create and improve detections, threat signatures, and guardrails
• Participate in a periodic on-call rotation

Required qualifications

• Strong experience in incident response, security investigations, and running incidents as the Incident Commander
• Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads
• Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry
• Knowledge of securing frontier AI infrastructure, including model training and serving pipelines and AI agent permissions
• Proven ability to detect and respond to modern AI-driven attacks
• Proficiency in Python to build automated orchestration pipelines
• Expert-level understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes)
• Ability to translate incident findings and root-cause analysis into tactical fixes and security engineering objectives
• Ability to perform static and dynamic malware analysis using sandbox environments and AI-assisted reverse engineering tools

Nice to have

• 2+ years of relevant experience in incident response or security operations
• Experience with threat hunting or building detection-as-code programs
• Experience running sensitive investigations alongside Legal and HR, such as insider risk cases
• Familiarity with large-scale data platforms and using them to analyze security telemetry
• Contributions to open-source security tooling, detection rules, or the broader security community
• Industry certifications such as GCIH, GCFA, or GREM

About the company

Snowflake is a fast-growing software company powering the era of the agentic enterprise.