# Incident Response Engineer
**Company:** [Snowflake](https://scaleengineer.com/companies/snowflake)
Join Snowflake's Incident Response team as a Security Incident Response Engineer and help redefine incident handling at scale by combining autonomous AI agents with human expertise. This senior-level role focuses on detecting, investigating, and containing threats across Snowflake's rapidly expanding cloud and AI infrastructure through innovative agentic workflows, security automation, and advanced threat analysis. You'll lead critical security investigations, build sophisticated incident response automation pipelines, and shape the future of enterprise security operations in the AI-native era.
**Role:** Security Engineer
**Seniority:** Senior
**Locations:** US-CA-Bay Area-Remote
**Remote:** yes
**Salary:** 143000–205800 USD
[Apply](https://jobs.ashbyhq.com/snowflake/88a70f56-834d-44d4-add8-e36b739e5495)
Canonical: https://scaleengineer.com/jobs/snowflake/incident-response-engineer
---
## Responsibilities

- Lead Agentic Incident Response Operations: Spearhead deployment, configuration, and continuous refinement of autonomous AI agents that execute initial incident triage, context gathering, and rapid investigation workflows. Partner with these agentic systems alongside human Incident Commanders to accelerate threat detection and response times across Snowflake's cloud infrastructure and AI platforms.
- Manage Critical Security Incidents: Handle escalations and serve as Incident Commander for critical security incidents affecting Snowflake's data platform. Direct incident response efforts, coordinate cross-functional teams, and ensure proper containment, eradication, and recovery procedures are executed with precision and speed.
- Build Incident Response Automation: Develop and maintain sophisticated automation pipelines, scripts, and agentic workflows using Python and industry-standard orchestration tools. These systems should continuously reduce manual toil, programmatically enrich security alerts, and enable faster investigation cycles across the security stack.
- Conduct Advanced Threat Analysis: Perform static and dynamic malware analysis using sandbox environments and AI-assisted reverse engineering tools. Translate incident findings and root-cause analysis into both immediate tactical security fixes and long-term strategic engineering objectives that strengthen Snowflake's defenses.
- Enhance Detection and Threat Signatures: Create, refine, and improve security detections, threat signatures, and guardrails specifically designed to identify both traditional attack vectors and emerging AI-driven threats targeting frontier AI infrastructure, model training pipelines, and AI agent permission models.
- Cross-Functional Security Collaboration: Partner closely with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams to ensure holistic incident response capabilities. Participate in sensitive investigations including insider risk cases, coordinating closely with Legal and HR on complex security matters.
- Maintain On-Call Readiness: Participate in periodic on-call rotation responsibilities with flexibility for non-traditional working hours. Ensure rapid response capabilities are maintained for emerging security incidents affecting Snowflake's infrastructure and customer data platforms.

## Requirements

### education

- {"name":"Bachelor's Degree (Preferred)","description":"Bachelor's degree in Computer Science, Cybersecurity, Information Security, or related field. Equivalent professional experience in incident response and security operations is acceptable and equally valued."}

### technical

- {"name":"Advanced Security Stack Proficiency","description":"Expert-level experience with EDR (Endpoint Detection and Response), SIEM (Security Information and Event Management), SOAR (Security Orchestration, Automation and Response), and DLP (Data Loss Prevention) solutions across endpoints, identity providers, SaaS applications, and cloud workloads. Demonstrated ability to configure, tune, and optimize these tools for maximum detection efficacy."}
- {"name":"Python Programming","description":"Proficiency in Python to build automated orchestration pipelines, reduce manual incident response overhead, and programmatically enrich security alerts with contextual threat intelligence. Experience with libraries and frameworks commonly used in security automation and data processing."}
- {"name":"Cloud Security Architecture","description":"Expert-level understanding of cloud security architectures across AWS, GCP, or Azure. Knowledge of cloud-native threat vectors, identity and access management at scale, network security in distributed environments, and cloud compliance frameworks relevant to incident response operations."}
- {"name":"Container and Kubernetes Security","description":"Advanced knowledge of container runtime isolation technologies including Docker and Kubernetes. Understanding of container escape vectors, image vulnerabilities, supply chain security, and orchestration-level attack surfaces in containerized infrastructure."}
- {"name":"AI/LLM Security Expertise","description":"Deep familiarity with AI and LLM tooling, security copilots, and AI-driven telemetry systems used to accelerate investigations and threat triage. Experience with securing frontier AI infrastructure including model training and serving pipelines, AI agent permissions frameworks, and detection of AI-driven attacks."}
- {"name":"Malware Analysis Capabilities","description":"Ability to perform both static and dynamic malware analysis using sandbox environments and modern AI-assisted reverse engineering tools. Competency in identifying malware behavior patterns, determining indicators of compromise, and assessing threat severity in incident investigations."}

### experience

- {"name":"Incident Response Leadership","description":"2+ years of relevant incident response or security operations experience with strong capability to lead security investigations and serve as Incident Commander for critical incidents. Hands-on experience managing incidents from initial detection through investigation, containment, and post-incident analysis."}
- {"name":"AI-Driven Threat Detection","description":"Proven ability to detect, investigate, and respond to modern AI-driven attacks targeting machine learning systems, large language models, and AI infrastructure. Experience translating emerging AI security threats into actionable detection rules and incident response procedures."}
- {"name":"Security Automation Development","description":"Track record of building and improving security automation workflows that reduce incident response time, eliminate manual toil, and improve detection accuracy. Experience orchestrating multiple security tools and data sources to create cohesive incident response processes."}

## Skills

### required

- {"name":"Incident Response & Investigation","description":"Master-level incident response methodology, forensic investigation techniques, and incident command capabilities with ability to orchestrate complex, multi-team security incidents."}
- {"name":"Security Tools Integration","description":"Advanced expertise with EDR, SIEM, SOAR, and DLP platforms. Ability to perform queries, tune detections, and extract actionable intelligence across multiple security tools simultaneously."}
- {"name":"Python Automation","description":"Strong Python development skills focused on building incident response automation, alert enrichment scripts, and orchestration workflows that integrate multiple security data sources."}
- {"name":"Cloud Security Analysis","description":"Deep understanding of cloud-native security architectures, cloud incident response procedures, and cloud-specific threat vectors across AWS, GCP, or Azure environments."}
- {"name":"AI/LLM Security","description":"Expertise in AI security risks, LLM attack vectors, and incident response specific to frontier AI infrastructure. Ability to identify and respond to AI-driven compromise attempts."}
- {"name":"Malware Analysis","description":"Capability to perform static and dynamic malware analysis, reverse engineering, and behavioral forensics using sandbox environments and modern analysis tools."}
- {"name":"Root Cause Analysis","description":"Ability to translate complex incident findings into clear root cause analysis, tactical security fixes, and strategic long-term security engineering improvements."}

### preferred

- {"name":"Threat Hunting Expertise","description":"Experience developing and executing proactive threat hunting campaigns, detection engineering, or building detection-as-code programs to identify advanced threats before incidents occur."}
- {"name":"Sensitive Investigation Experience","description":"Track record conducting complex investigations requiring Legal and HR coordination, including insider risk cases, data exfiltration scenarios, and sensitive security matters requiring discretion."}
- {"name":"Large-Scale Data Platform Experience","description":"Familiarity with large-scale data platforms and demonstrated ability to query and analyze massive volumes of security telemetry data to identify attack patterns and anomalies."}
- {"name":"Open Source Security Community","description":"Active contributions to open-source security tooling, detection rules, YARA signatures, or active participation in the broader security community demonstrating thought leadership."}
- {"name":"Industry Certifications","description":"Relevant security certifications such as GCIH (Global Certified Incident Handler), GCFA (GIAC Certified Forensic Analyst), or GREM (GIAC Reverse Engineering Malware) demonstrating formal security expertise validation."}
- {"name":"AI Security Certifications","description":"Specialized certifications in AI security, machine learning security, or secure LLM development demonstrating advanced knowledge in emerging AI threat landscapes."}

## Tech stack

### tools

- {"name":"EDR/MDR Platforms","description":"Tools like CrowdStrike, Microsoft Defender, SentinelOne, or Velociraptor for endpoint visibility, threat detection, and forensic investigation during incidents."}
- {"name":"SIEM Solutions","description":"Platforms such as Splunk, Elastic Security, Microsoft Sentinel, or Google Chronicle for centralized security event management and incident correlation."}
- {"name":"DLP/Data Security Tools","description":"Data Loss Prevention and data protection technologies for preventing sensitive data exfiltration and identifying insider risk scenarios during investigations."}
- {"name":"Incident Management Systems","description":"Platforms like PagerDuty, Opsgenie, or ServiceNow for coordinating incident response, maintaining on-call rotations, and tracking incident timelines and communication."}
- {"name":"Malware Analysis Sandboxes","description":"Tools such as Cuckoo Sandbox, Any.run, or Hybrid Analysis for dynamic malware analysis, behavioral forensics, and AI-assisted reverse engineering."}
- {"name":"Threat Intelligence Platforms","description":"Services for accessing threat intelligence feeds, indicator lookups, and contextual threat data to enhance incident investigation and response decisions."}
- {"name":"Container Security Tools","description":"Tools for Docker and Kubernetes security monitoring, image scanning, and runtime threat detection in containerized incident response environments."}

### others

- {"name":"AWS Cloud Infrastructure","description":"Amazon Web Services platform expertise including EC2, S3, IAM, CloudTrail, and VPC security for investigating and responding to cloud-based security incidents."}
- {"name":"GCP Cloud Infrastructure","description":"Google Cloud Platform services including Compute Engine, Cloud Storage, Cloud Audit Logs, and VPC for cloud-native incident response operations."}
- {"name":"Azure Cloud Infrastructure","description":"Microsoft Azure cloud services including Virtual Machines, Storage, Entra ID, and Azure activity logs for cloud incident investigation and response."}
- {"name":"Kubernetes & Docker","description":"Container orchestration and containerization technologies for understanding container-based threat vectors and responding to containerized infrastructure incidents."}
- {"name":"AI Agent Frameworks","description":"Emerging autonomous AI agent platforms and agentic workflow systems for deploying and managing security automation agents that enhance incident response capabilities."}
- {"name":"LLM/Security Copilot Platforms","description":"Large language model-based security tools and AI-powered security copilots for accelerating threat investigation, alert triage, and incident analysis."}
- {"name":"Version Control Systems","description":"Git and repository management for maintaining incident response automation code, detection rules, and collaborative security engineering practices."}

### databases

- {"name":"Snowflake Data Platform","description":"Cloud-native data warehouse and analytics platform for storing, querying, and analyzing massive volumes of security telemetry and incident response data."}
- {"name":"Security Telemetry Data Lakes","description":"Large-scale security data repositories for consolidating EDR, network, cloud, and identity logs to enable comprehensive incident investigation and threat hunting."}
- {"name":"Time-Series Databases","description":"Specialized databases for storing and querying security metrics, detection signals, and temporal event data relevant to incident timeline reconstruction."}

### languages

- {"name":"Python","description":"Primary automation language for building incident response orchestration pipelines, security alert enrichment, and tooling integrations across Snowflake's security stack."}
- {"name":"Bash/Shell","description":"System scripting for log analysis, forensic investigation automation, and cloud resource queries in incident response workflows."}
- {"name":"SQL","description":"Query language for analyzing security telemetry, event logs, and large-scale data platform queries to investigate incidents and identify threat patterns."}

### frameworks

- {"name":"SOAR Platforms","description":"Security Orchestration, Automation and Response frameworks for building automated incident response playbooks and coordinating multi-tool security operations."}
- {"name":"EDR Solutions","description":"Endpoint Detection and Response platforms for comprehensive endpoint telemetry collection, threat hunting, and forensic analysis during incident investigations."}
- {"name":"SIEM Architectures","description":"Security Information and Event Management systems for centralized log collection, correlation, real-time alerting, and historical security incident analysis at scale."}

## Benefits

### benefits

## Compensation

- **max:** 200000
- **min:** 160000
- **currency:** USD
- **stockOptions:** true

## Interview process

### steps

## Full description
At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done.

We are hiring a Security Incident Response Engineer to join our Incident Response team. You will help redefine how incidents are handled at scale, pairing autonomous AI agents with human judgment so that we can detect, investigate, and contain threats faster across a rapidly growing cloud and AI footprint.

## AS A SECURITY INCIDENT RESPONSE ENGINEER AT SNOWFLAKE, YOU WILL:

* Join a high-impact team of security experts to scale security at one of the fastest-growing software companies ever
* Spearhead an agentic approach to Incident Response by deploying, guiding, and refining autonomous AI agents that execute initial triage, context gathering, and rapid investigation alongside human Incident Commanders
* Handle escalations, lead security investigations, and act as Incident Commander for critical incidents
* Build scripts, automation pipelines, and agentic workflows that continuously enhance Snowflake's incident response capabilities
* Partner closely with our Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams
* Create and improve detections, threat signatures, and guardrails for both traditional and AI-driven attack vectors
* Participate in a periodic on-call rotation, which may involve non-traditional working hours

## OUR IDEAL SECURITY INCIDENT RESPONSE ENGINEER WILL HAVE:

* 2+ years of relevant experience in incident response or security operations preferred
* Strong experience in incident response, security investigations, and running incidents as the Incident Commander
* Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads
* Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry to accelerate investigations, threat triage, and post-incident reporting
* Knowledge of securing frontier AI infrastructure, including model training and serving pipelines and AI agent permissions
* Proven ability to detect and respond to modern AI-driven attacks
* Proficiency in Python to build automated orchestration pipelines, reduce manual incident response toil, and programmatically enrich security alerts
* Expert-level understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes)
* Ability to translate incident findings and root-cause analysis into short-term tactical fixes and long-term security engineering objectives
* Ability to perform static and dynamic malware analysis using sandbox environments and modern AI-assisted reverse engineering tools

## BONUS POINTS FOR THE FOLLOWING:

* Experience with threat hunting or building detection-as-code programs
* Experience running sensitive investigations alongside Legal and HR, such as insider risk cases
* Familiarity with large-scale data platforms and using them to analyze security telemetry
* Contributions to open-source security tooling, detection rules, or the broader security community
* Industry certifications such as GCIH, GCFA, or GREM

## WHY JOIN OUR INCIDENT RESPONSE TEAM AT SNOWFLAKE?

This is an opportunity to shape what incident response looks like in the agentic era. You will work on the front line of defending one of the world's most important data platforms, building the AI-driven workflows that let a team of experts respond with the speed and precision that modern threats demand.

You will work across Detection, Product Security, Cloud, Legal, and HR, see incidents end to end, and turn what you learn into lasting improvements to how Snowflake protects its customers and its people.

Snowflake is growing fast, and we’re scaling our team to help enable and accelerate our growth. We are looking for people who share our values, challenge ordinary thinking, and push the pace of innovation while building a future for themselves and Snowflake.

How do you want to make your impact?

For jobs located in the United States, please visit the job posting on the Snowflake Careers Site for salary and benefits information: [careers.snowflake.com](http://careers.snowflake.com)