← All roles

Incident Response Engineer

Snowflake Inc.· Engineering
Apply on company site
Remote$143k - $205.8kFull-timePosted 4d ago

About the role

Security Incident Response Engineer to join Snowflake's Incident Response team, focusing on deploying autonomous AI agents for triage, investigation, and containment of threats at scale across a growing cloud and AI footprint.

Responsibilities

  • Join a high-impact team of security experts to scale security at one of the fastest-growing software companies ever
  • Spearhead an agentic approach to Incident Response by deploying, guiding, and refining autonomous AI agents that execute initial triage, context gathering, and rapid investigation alongside human Incident Commanders
  • Handle escalations, lead security investigations, and act as Incident Commander for critical incidents
  • Build scripts, automation pipelines, and agentic workflows that continuously enhance Snowflake's incident response capabilities
  • Partner closely with our Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams
  • Create and improve detections, threat signatures, and guardrails for both traditional and AI-driven attack vectors
  • Participate in a periodic on-call rotation, which may involve non-traditional working hours

Qualifications

  • 2+ years of relevant experience in incident response or security operations preferred
  • Strong experience in incident response, security investigations, and running incidents as the Incident Commander
  • Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads
  • Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry to accelerate investigations, threat triage, and post-incident reporting
  • Knowledge of securing frontier AI infrastructure, including model training and serving pipelines and AI agent permissions
  • Proven ability to detect and respond to modern AI-driven attacks
  • Proficiency in Python to build automated orchestration pipelines, reduce manual incident response toil, and programmatically enrich security alerts
  • Expert-level understanding of cloud security architectures (AWS, GCP, or Azure) and container runtime isolation (Docker, Kubernetes)
  • Ability to translate incident findings and root-cause analysis into short-term tactical fixes and long-term security engineering objectives
  • Ability to perform static and dynamic malware analysis using sandbox environments and modern AI-assisted reverse engineering tools

Skills

Required:Incident responseSecurity tooling (EDR, SIEM, SOAR, DLP)PythonCloud security (AWS/GCP/Azure)AI/LLM tooling
Nice to have:Malware analysis

Benefits

  • N/A not specified in description
Last updated Oct 22, 2026. Interested? Apply on the company site.

About Snowflake Inc.

The Data Platform Built for Data Teams.

Snowflake powers AI, data engineering, applications, and analytics on a trusted, scalable AI Data Cloud—eliminating silos and accelerating innovation.

AIData CloudData EngineeringAnalyticsApplications & Collaboration
Company profileWebsite

More open roles at Snowflake Inc.