Incident Response Engineer

Join a high-impact team of security experts to scale security at one of the fastest-growing software companies ever

Spearhead an agentic approach to Incident Response by deploying, guiding, and refining autonomous AI agents that execute initial triage, context gathering, and rapid investigation alongside human Incident Commanders

Handle escalations, lead security investigations, and act as Incident Commander for critical incidents

Build scripts, automation pipelines, and agentic workflows that continuously enhance Snowflake's incident response capabilities

Partner closely with our Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams

Create and improve detections, threat signatures, and guardrails for both traditional and AI-driven attack vectors

Participate in a periodic on-call rotation, which may involve non-traditional working hours

2+ years of relevant experience in incident response or security operations preferred

Strong experience in incident response, security investigations, and running incidents as the Incident Commander

Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads

Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry to accelerate investigations, threat triage, and post-incident reporting

Knowledge of securing frontier AI infrastructure, including model training and serving pipelines and AI agent permissions

Proven ability to detect and respond to modern AI-driven attacks

Proficiency in Python to build automated orchestration pipelines, reduce manual incident response toil, and programmatically enrich security alerts

Expert-level understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes)

Ability to translate incident findings and root-cause analysis into short-term tactical fixes and long-term security engineering objectives

Ability to perform static and dynamic malware analysis using sandbox environments and modern AI-assisted reverse engineering tools

Experience with threat hunting or building detection-as-code programs

Experience running sensitive investigations alongside Legal and HR, such as insider risk cases

Familiarity with large-scale data platforms and using them to analyze security telemetry

Contributions to open-source security tooling, detection rules, or the broader security community

Industry certifications such as GCIH, GCFA, or GREM

This is an opportunity to shape what incident response looks like in the agentic era. You will work on the front line of defending one of the world's most important data platforms, building the AI-driven workflows that let a team of experts respond with the speed and precision that modern threats demand.

You will work across Detection, Product Security, Cloud, Legal, and HR, see incidents end to end, and turn what you learn into lasting improvements to how Snowflake protects its customers and its people.

Snowflake is growing fast, and we’re scaling our team to help enable and accelerate our growth. We are looking for people who share our values, challenge ordinary thinking, and push the pace of innovation while building a future for themselves and Snowflake.

How do you want to make your impact?

For jobs located in the United States, please visit the job posting on the Snowflake Careers Site for salary and benefits information: careers.snowflake.com