Incident Response Engineer

An engineer on Snowflake's Incident Response team, working remotely in the California Bay Area, who pairs autonomous AI agents with human judgment to detect, investigate and contain threats across a growing cloud and AI estate.

The engineer handles escalations and leads investigations, acts as Incident Commander on critical incidents, tunes the agents that do first triage and context gathering, builds automation and detections for both conventional and AI-driven attacks, works with legal, HR, cloud and detection teams, and joins an on-call rotation. Snowflake prefers two or more years in incident response or security operations, deep use of EDR, SIEM and SOAR across endpoints, identity, SaaS and cloud, Python automation, cloud and container security knowledge, and malware analysis skills.