Twitch
Security Incident Response Engineer
$159K–$213K
Irvine, CA +1 · Full-time · Posted Sep 16, 2026
- Location
- Irvine, CA
San Francisco, CA - Experience
- 3+ years of relevant information security work or an equivalent BS degree in a related field.
- Education
- Equivalent BS degree in Information Security, Information Systems, Computer Science, Computer Engineering, or another related field is stated as an alternative to the experience requirement. Bonus: B.S. or M.S. in a related technical discipline.
About the job
Responds to security incidents across Twitch by coordinating investigations, assessing impact, improving defenses, and automating security operations.
What you'll do
- Qualify alerts and reports, investigate incidents, assess impact, and analyze threat actor tactics, techniques, and procedures.
- Coordinate response with affected teams; communicate incident timelines and impact to peers and leadership.
- Build and document security-operation automations, lead lessons learned, and help prevent recurrence.
What they ask for
- Automation experience using scripting or programming languages such as Go, Python, Ruby, Shell, or Perl.
- Ability to securely design and implement AI/ML-driven playbooks for common security operations.
- Experience coordinating responses to security incidents; knowledge of security issues and the threat landscape.
- Background in cloud, host, network, and application security; familiarity with incident response frameworks or lifecycle models.
Nice to have
- Experience handling incidents in hybrid cloud environments (AWS, GCP) and analyzing cloud telemetry such as CloudTrail.
- Experience or familiarity with streaming and content creation.
Pay
$159,300 — $202,400 USD base salary (Seattle); $166,600 — $212,800 USD base salary (San Francisco); $159,300 — $202,400 USD base salary (Irvine)
Tools
Go, Python, Ruby, Shell, Perl, AI/ML, AWS, GCP
AI focus
Design and implement AI/ML-driven playbooks and agentic automations for detection, enrichment, triage, response, and communication.
Model-written summary · the original posting is authoritative