Senior Security Engineer, Incident Response

Snowflake is powering the era of the agentic enterprise and seeks AI-native thinkers to help reinvent how work gets done. The Senior Security Engineer will lead and architect product-integrated incident response capabilities focused on AI and LLM security across Snowflake’s AI products, while developing detection, containment, remediation, and automation strategies for AI-related security incidents.

Responsibilities:

• Lead incident response for product-level security events, with deep focus on AI-specific threat vectors including prompt injection, model abuse, agent hijacking, and data exfiltration through AI workloads
• Integrate IR into AI product pipelines - work directly with teams shipping Cortex features, Snowflake Intelligence, and AI-powered developer experiences to embed security requirements from design through deployment
• Develop and codify our AI abuse response strategy - defining detection, containment, and remediation playbooks for LLM misuse, adversarial inputs, and AI-assisted attacks targeting Snowflake customers
• Address tech debt across the AI product stack, ensuring that new Cortex and agentic architectures meet IR readiness requirements from the ground up
• Represent the IR team to cloud engineering, AI platform teams, corporate security, and customer-facing business units
• Secure modern AI-native codebases operating across multi-cloud environments - including container-based inference services, RAG pipelines, vector stores, and agent orchestration layers
• Partner with world-class AI and security engineering teams, providing expert guidance on secure architecture for high-impact AI features and customer-facing AI capabilities
• Design and manage response capabilities built into Snowflake's AI operational infrastructure - from model serving endpoints to Cortex Search indexes and Snowpark ML pipelines
• Lead with data, code, and automation - build tooling that accelerates detection and response for product security incidents at Snowflake scale
• Drive meaningful security outcomes for the customers and enterprises trusting Snowflake with their most sensitive data and AI workloads

Requirements:

• • Direct experience serving as incident commander for product focused security incidents
• • Experience leading or actively building an application or security engineering program, with a clear point of view on securing AI/ML systems
• • Experience with threat modeling and security testing across AI attack surfaces, including prompt injection, indirect injection, model inversion, embedding extraction, and supply chain attacks on AI dependencies
• • Familiarity with the unique data governance and security challenges introduced by LLMs, RAG architectures, and agentic systems
• • Working knowledge of cloud-native environments (AWS, Azure, GCP) and the threat landscape specific to SaaS and AI platforms
• • SQL proficiency, plus experience building automation and tools with common programming languages (Python preferred)
• • Strong communication skills, with the ability to translate security risk into actionable guidance for product teams
• • Empathy for developer experience, helping AI engineers ship securely rather than slowing them down
• • Bachelor's degree in Computer Science or a related field, or equivalent experience
• • Experience securing AI/ML infrastructure, including model serving, vector databases, embedding pipelines, API gateways, and LLM-integrated application architectures
• • Experience building agentic incident response capabilities, including skills, agents, and pipelines
• • Understanding of current attacker TTPs, including emerging AI-specific techniques such as adversarial ML, agent manipulation, and LLM jailbreaking in enterprise contexts
• • Familiarity with CI/CD and secure release lifecycle patterns, with an emphasis on building security into AI feature pipelines
• • 5+ years of experience in information security, primarily in incident response, security engineering, or product/application security (preferred)
• • Preferred certifications: GCIA, GCIH, GCSA, GDAT, CISSP/GISP, or cloud certifications (AWS, Azure, GCP)