Twitch
Security Incident Response Engineer
$159K–$213K
San Francisco, CA · Full-time · Posted Sep 16, 2026
- Experience
- 3+ years of relevant information security experience, or an equivalent BS degree in a related field.
- Education
- BS degree in Information Security, Information Systems, Computer Science, Computer Engineering, or another related field; alternatively, 3+ years of relevant experience. A B.S. or M.S. in a related technical discipline is a bonus.
About the job
Responds to security incidents across Twitch’s platform by investigating threats, coordinating response, automating security operations, and helping prevent recurrence.
What you'll do
- Qualify alerts and reports as incidents, assess their impact, and analyze threat actor tactics, techniques, and procedures.
- Coordinate incident response with affected teams; communicate event timelines, impact, discovery, and response to peers and leadership.
- Build and improve security-response automations, document procedures, and lead lessons-learned discussions.
What they ask for
- Automation experience using scripting or programming languages such as Go, Python, Ruby, Shell, or Perl.
- Ability to securely design and implement AI/ML-driven playbooks for common security operations.
- Experience coordinating responses to security incidents.
- Knowledge of security issues and the threat landscape, with a background in cloud, host, network, and application security.
Nice to have
- Experience handling incidents in hybrid cloud environments (AWS, GCP) and analyzing cloud telemetry such as CloudTrail.
- Experience or familiarity with streaming and content creation.
Pay
$159,300 — $202,400 USD base salary; $166,600 — $212,800 USD base salary; $159,300 — $202,400 USD base salary
Tools
Go, Python, Ruby, Shell, Perl, AWS, GCP, CloudTrail
AI focus
Investigate, document, and implement agentic detection, enrichment, triage, response, and communication automations; securely design and implement AI/ML-driven playbooks for common security operations.
Model-written summary · the original posting is authoritative