Security Incident Response Engineer

At Snowflake, we are powering the era of the agentic enterprise. To usher in this new era, we seek AI-native thinkers across every function who are energized by the opportunity to reinvent how they work. You don’t just use tools; you possess an innate curiosity, treating AI as a high-trust collaborator that is core to how you solve problems and accelerate your impact. We look for low-ego individuals who thrive in dynamic and fast-moving environments and move with an experimental mindset — who rapidly test emerging capabilities to discover simpler, more powerful ways to deliver results. At Snowflake, your role isn't just to execute a function, but to help redefine the future of how work gets done.

We are hiring a Security Incident Response Engineer to join our Incident Response team. You will help redefine how incidents are handled at scale, pairing autonomous AI agents with human judgment so that we can detect, investigate, and contain threats faster across a rapidly growing cloud and AI footprint.

AS A SECURITY INCIDENT RESPONSE ENGINEER AT SNOWFLAKE, YOU WILL:

• Join a high-impact team of security experts to scale security at one of the fastest-growing software companies ever

• Spearhead an agentic approach to Incident Response by deploying, guiding, and refining autonomous AI agents that execute initial triage, context gathering, and rapid investigation alongside human Incident Commanders

• Handle escalations, lead security investigations, and act as Incident Commander for critical incidents

• Build scripts, automation pipelines, and agentic workflows that continuously enhance Snowflake's incident response capabilities

• Partner closely with our Threat Detection, Automation, Product Security, Legal, HR, Cloud, and Data teams

• Create and improve detections, threat signatures, and guardrails for both traditional and AI-driven attack vectors

• Participate in a periodic on-call rotation, which may involve non-traditional working hours

OUR IDEAL SECURITY INCIDENT RESPONSE ENGINEER WILL HAVE:

• 2+ years of relevant experience in incident response or security operations preferred

• Strong experience in incident response, security investigations, and running incidents as the Incident Commander

• Advanced experience using security stack capabilities (EDR, SIEM, SOAR, DLP) across endpoints, identity providers, SaaS, and cloud workloads

• Deep familiarity with AI/LLM tooling, security copilots, and AI-driven telemetry to accelerate investigations, threat triage, and post-incident reporting