Engineering Manager, Security (Cloud, Infrastructure & Application Security)

Location: Hybrid role in Foster City, California, United States

Salary: $250K–$387K

Company

Replit is an agentic software creation platform that enables users to build applications with natural language.

What you will do

• Lead cloud security, infrastructure vulnerability management, application security, and Secure SDLC teams, including hiring, mentoring, career development, and performance management.
• Define security roadmaps, quarterly OKRs, ownership models, escalation processes, and executive reporting for security posture and risk trends.
• Own vulnerability remediation SLAs across cloud, infrastructure, containers, and application code, including exception management, automated routing, metrics, and audit evidence.
• Oversee security posture and secure baselines across GCP, AWS, Azure, Kubernetes, containers, data stores, SaaS platforms, and AI infrastructure.
• Run SCA, SAST, and IaC scanning programs, software supply chain security, CI/CD integrations, SBOMs, artifact signing, and SLSA progress.
• Build Secure SDLC practices, threat modeling, secure design reviews, developer training, security champions, and incident follow-up remediation.

Requirements

• 8+ years in security engineering, cloud security, or DevSecOps, including 2+ years managing security engineers or 3+ years as a tech lead with formal people-leadership responsibility.
• Hands-on GCP cloud security expertise plus working knowledge of AWS and/or Azure, including IAM, networking, logging, organization policies, and security services.
• Experience running vulnerability management programs at scale and driving remediation across multiple engineering teams within SLAs.
• Hands-on experience with CSPM/CNAPP platforms and with SCA, SAST, and IaC scanning tools integrated into CI/CD.
• Strong Kubernetes, container security, and Infrastructure-as-Code knowledge, including Terraform or similar tools.
• Experience building or maturing Secure SDLC programs and delivering developer security training.
• Ability to write and review code or automation in Python, Go, TypeScript, or similar languages.
• Understanding of remediation SLAs and security controls mapped to SOC 2, ISO 27001, PCI DSS, FedRAMP, CIS, and NIST, including audit evidence production.
• Working knowledge of cloud-native incident response and excellent communication skills for influencing engineering leaders and explaining business risk.

Nice to have

• Experience securing developer platforms, multi-tenant SaaS, or AI/ML infrastructure.
• Experience with SLSA, Sigstore, SBOM standards, Security Champions programs, or developer-facing security tooling.
• Experience leading the security side of SOC 2 Type II, ISO 27001, PCI DSS, or FedRAMP audits.
• Relevant certifications such as CCSP, GCP Professional Cloud Security Engineer, OSCP, or CSSLP.

Culture & Benefits

• Full-time employee role with competitive salary and equity.
• 401(k) program with a 4% match, available in the US, plus health, dental, vision, life, and disability insurance.
• Paid parental, medical, and caregiver leave, flexible time off, and holidays.
• Autonomous work environment, quarterly team gatherings, and monthly wellness stipend.
• In-office setup reimbursement, commuter benefits, and office amenities for applicable in-office employees.