Twitch
Security Incident Response Engineer
$159K–$213K
Seattle, WA +1 · Full-time · Posted Sep 16, 2026
- Location
- Seattle, WA
San Francisco, CA - Experience
- 3+ years of relevant information security work or an equivalent BS degree in a related field.
- Education
- Equivalent BS degree in Information Security, Information Systems, Computer Science, Computer Engineering, or another related field; a B.S. or M.S. in a related technical discipline is a bonus.
About the job
Responds to security incidents across Twitch’s platform, coordinating investigations, impact assessment, automation, and lessons learned.
What you'll do
- Qualify alerts and reports, investigate incidents, assess impact, and analyze threat actor tactics, techniques, and procedures.
- Coordinate incident response with affected teams and communicate event timelines, impact, discovery, and response.
- Develop and implement security operations automations, document procedures, and lead lessons learned to reduce recurrence.
What they ask for
- Automation experience using scripting or programming languages such as Go, Python, Ruby, Shell, or Perl.
- Ability to securely design and implement AI/ML-driven playbooks to automate common security operations.
- Experience coordinating responses to security incidents; knowledge of security issues and the threat landscape.
- Background in cloud, host, network, and application security; familiarity with incident response frameworks or lifecycle models.
Nice to have
- Experience handling security incidents in a hybrid cloud environment (AWS, GCP) and analyzing cloud telemetry such as CloudTrail.
- Experience or familiarity with streaming and content creation.
Pay
$159,300 — $202,400 USD base salary; $166,600 — $212,800 USD base salary; $159,300 — $202,400 USD base salary
Tools
Go, Python, Ruby, Shell, Perl, AWS, GCP, CloudTrail
AI focus
Securely design and implement AI/ML-driven playbooks and agentic automations for detection, enrichment, triage, response, and communication.
Model-written summary · the original posting is authoritative