Security Incident Response Engineer (AI)

Location: Remote within the United States, with a focus on the Bay Area

Salary: $143,000–$205,800 per year

Company

Snowflake provides a large-scale cloud data platform and is expanding its security capabilities for cloud and AI-driven workloads.

What you will do

• Deploy, guide, and refine autonomous AI agents for incident triage, context gathering, and rapid investigation.
• Handle escalations, lead security investigations, and serve as Incident Commander for critical incidents.
• Build Python scripts, automation pipelines, and agentic workflows to reduce manual incident response effort.
• Create and improve detections, threat signatures, and guardrails for traditional and AI-driven attack vectors.
• Collaborate with Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams.
• Participate in a periodic on-call rotation that may include non-traditional working hours.

Requirements

• At least 2 years of relevant incident response or security operations experience preferred.
• Strong experience with security investigations, incident response, and incident command.
• Advanced experience with EDR, SIEM, SOAR, and DLP across endpoints, identity providers, SaaS, and cloud workloads.
• Deep familiarity with AI/LLM tooling, security copilots, AI-driven telemetry, and securing AI training, serving, and agent permission pipelines.
• Proficiency in Python and expert-level knowledge of cloud security architectures, Docker, and Kubernetes.
• Ability to perform static and dynamic malware analysis and translate root-cause findings into tactical fixes and long-term security engineering objectives.

Nice to have

• Experience with threat hunting, detection-as-code, or large-scale security telemetry analysis.
• Experience handling sensitive insider-risk investigations with Legal and HR.
• Contributions to open-source security tooling, detection rules, or the security community.
• Certifications such as GCIH, GCFA, or GREM.

Culture & Benefits

• Work in a fast-moving environment with an experimental, AI-native approach to problem-solving.
• Collaborate across security, cloud, data, product, legal, and HR functions.
• Work on the front line of protecting a major cloud data platform and its customers.
• Remote work within the United States with periodic on-call responsibilities.