Snowflake
Incident Response Engineer
$143K–$206K
US-CA-Bay Area-Remote · Remote · Full-time · Posted Oct 16, 2026
- Experience
- 2+ years of relevant experience in incident response or security operations preferred.
About the job
Handles security incidents and investigations, serving as Incident Commander while building AI-agent workflows and automation to improve threat detection, investigation, and containment.
What you'll do
- Deploy and refine autonomous AI agents for initial triage, context gathering, and investigation alongside human Incident Commanders.
- Lead investigations and critical incidents; improve detections, threat signatures, and security guardrails.
- Build scripts, automation pipelines, and agentic workflows; participate in periodic on-call rotation.
What they ask for
- Strong experience in incident response, security investigations, and incident command.
- Advanced experience with EDR, SIEM, SOAR, and DLP across endpoints, identity providers, SaaS, and cloud workloads.
- Proficiency in Python; expert-level understanding of AWS, GCP, or Azure security and Docker or Kubernetes runtime isolation.
- Experience detecting and responding to AI-driven attacks; familiarity with AI/LLM security tooling and frontier AI infrastructure.
Nice to have
- 2+ years of relevant incident response or security operations experience (preferred).
- Threat hunting or detection-as-code experience; sensitive investigations with Legal and HR; large-scale data platforms; open-source security contributions; or certifications such as GCIH, GCFA, or GREM.
Pay
$143K – $205.8K (currency and whether base salary or total pay not stated)
Tools
EDR, SIEM, SOAR, DLP, Python, AWS, GCP, Azure
AI focus
Deploys and refines autonomous AI agents for incident triage and investigation; uses AI/LLM tools and AI-driven telemetry, and addresses threats to AI infrastructure and agent permissions.
Model-written summary · the original posting is authoritative