Replit SOC Engineer at Replit responsible for building and evolving the security data lake and detection engineering across cloud-native infrastructure. Supports incident investigations and develops custom detection rules.
Responsibilities
We are looking for a SOC Engineer to join our Security Operations team and help defend a fast-moving, cloud-native AI vibe-coding platform. In this role, your primary mandate will be building and evolving our security data lake, engineering reliable security telemetry, and owning high-fidelity detection engineering end-to-end. You will unify cloud, identity, endpoint, and application telemetry, staying on top of emerging threats to rapidly build and tune detections across our environment. Alongside this data and detection mandate, you will support incident investigations as needed to translate real-world threats into stronger automated defenses. This is a hands-on engineering role requiring strong technical depth, understanding of modern software engineering and CI/CD systems, familiarity with cloud-native infrastructure (especially GCP), and expertise in security data pipelines and detection workflows.
Security Data Lake & Detection Engineering: Architect, expand, and maintain our security data lake while designing, testing, and tuning custom detection rules to maximize threat coverage and minimize noise across our cloud-native stack.
Threat Awareness & Rapid Assessment: Continuously monitor emerging threats (0-days, bad actor activity, public exploitation campaigns, bug bounty reports, customer security issues) and rapidly assess their applicability to Replit's infrastructure, SaaS services, internal tools, and platform components.
Investigation & Impact Analysis: Conduct targeted investigations to determine impact, analyze logs, telemetry, and system behaviors using SIEM, metrics, and Cloud Logging and identify gaps in detection/visibility.
Qualification
Solid knowledge of cloud architectureFamiliarity with SaaS architecturesBonus QualificationsExperience with threat intelligenceFamiliarity with Kubernetes
Required
Building and evolving the security data lake, unifying cloud, identity, endpoint, and application telemetry; hands-on experience with SIEM, Cloud Logging, and log-based investigation workflows.
Engineering reliable security infrastructure and automation using infrastructure-as-code to close visibility gaps and perform log-based investigations.
Proven expertise in detection engineering end-to-end, specifically developing, testing, and tuning custom detection rules to maximize threat coverage and reduce noise across complex environments.
