Security Operations Lead at Replit — Foster City, CA

We are looking for a Security Operations Lead (SOC Lead) to build, mature, and operate our 24/7 detection and response capabilities across a modern cloud-native and AI-driven environment. This role leads the global SOC function—monitoring, SIEM ownership, detection engineering, alert triage, and operational readiness—while also evaluating and integrating emerging AI-based SOC products and autonomous response platforms.

You will oversee monitoring across multi-cloud environments (GCP primary, AWS/Azure secondary), Kubernetes, SaaS services, endpoints, developer tools, and AI workloads. You’ll collaborate closely with Cloud Security, Compliance/GRC, SRE, Platform Engineering, IT/Endpoint teams, and AI Infrastructure to ensure our detection strategy scales and stays ahead of evolving threats.

This is a hands-on leadership role perfect for someone who wants to shape the SOC of the future while solving complex challenges in a high-scale AI setting.

What You’ll Do

SOC Leadership & 24/7 Monitoring

• Lead, mentor, and scale a global SOC team responsible for 24/7 monitoring, alert intake, triage, correlation, and escalation.
• Build operational rigor: processes, runbooks, SLAs, metrics, and quality standards for high-scale environments.
• Cover monitoring across:
• Cloud infrastructure (GCP, AWS, Azure)
• Kubernetes/GKE/EKS/AKS clusters
• SaaS platforms (Google Workspace, GitHub, Slack, Okta, etc.)
• Endpoints (macOS, Linux, Windows) including EDR/XDR telemetry
• Developer platforms + CI/CD pipelines
• AI/ML systems and model-serving workflows

AI-Based SOC Integration & Innovation

• Evaluate, adopt, and integrate AI-native SOC technologies for triaging, detection, and correlation
• Identify opportunities to automate triage, investigations, enrichment, and reporting.
• Serve as the internal expert on the capabilities and limitations of AI-based SOC tooling.

SIEM & Telemetry Ownership

• Own the entire SIEM ecosystem—ingestion, normalization, correlation, enrichment, tuning, dashboards, and metrics.
• Expand telemetry across:
• Cloud logs, API logs, system events
• SaaS audit logs and admin events
• Identity providers (Okta, Google, Azure AD)
• Endpoint EDR/XDR event streams
• Standardize data schemas and improve detection signal quality across sources.

Detection Engineering

• Develop high-fidelity detections for:
• Cloud-native attacks
• Identity threats and lateral movement
• SaaS misconfigurations and privilege abuse
• Endpoint malware/behavior anomalies
• Insider threats and account takeover patterns
• Use MITRE ATT&CK, MITRE Cloud Matrix, and threat intel to drive detection coverage.
• Collaborate with Engineering, Cloud Security, and SRE to ensure telemetry supports detection use cases.

Triage, Threat Analysis & Escalation

• Lead day-to-day triage and threat analysis activities, ensuring accurate categorization and prioritization.
• Drive complex investigations involving correlated events across cloud, SaaS, endpoints, and developer platforms.
• Guide root cause analysis and work with owners to drive remediation and architectural improvements.
• Continuously refine logic, reduce false positives, and improve signal quality.

Cross-Functional Collaboration

• Partner with Cloud Security on cloud posture and preventative controls.
• Work with Compliance/GRC to support SOC 2, ISO 27001, and audit readiness.
• Collaborate with SRE and Engineering to instrument new services with structured logs and detection hooks.
• Coordinate with IT / Endpoint teams to ensure full endpoint telemetry and EDR response readiness.
• Communicate threats, gaps, and trends to leadership and engineering stakeholders.

Required Skills & Experience

• 7+ years of experience in Security Operations, with 3+ years in a senior or lead capacity.
• Experience leading or collaborating with 24/7 SOC environments (internal, hybrid, or MSSP).
• Strong experience with SIEM platforms (Chronicle, Splunk, Elastic, Sentinel, Panther, etc.).
• Deep understanding of:
• Cloud security monitoring (GCP required; AWS/Azure preferred)
• SaaS security monitoring (Okta, Google Workspace, GitHub, Slack, etc.)
• Endpoint security telemetry (EDR/XDR tools such as CrowdStrike, SentinelOne, or Defender)
• Kubernetes and container detection
• Hands-on detection engineering skills, event correlation, threat hunting, and log analysis.
• Familiarity with AI-based SOC platforms and LLM-driven detection/triage tools.
• Strong understanding of identity security, OAuth/OIDC, and API telemetry patterns.
• Experience with SOAR and scripting (Python, Go, Bash).
• Knowledge of MITRE ATT&CK, cloud kill chains, behavioral detections, and detection lifecycle management.

Preferred Qualifications

• Experience with UBA/UEBA, ML-driven anomaly detection, or autonomous remediation systems.
• Previous experience at a high-growth tech company.
• Security certifications (GCIH, GCIA, GCTI, GCDA, GCFA, etc.).

What We Value

• Operational excellence: Building reliable, scalable SOC systems.
• Analytical rigor: Capable of making sense of large, complex, multi-source telemetry.
• Leadership: Mentorship and guidance of analysts and engineers.
• Adaptability: Comfortable evaluating and integrating next-gen AI-based SOC tools.
• Clear communication: Able to articulate risk, incidents, and recommendations to both technical and executive audiences.
• Automation mindset: Focused on reducing manual toil via SOAR, scripting, and AI augmentation.

Curiosity: Passion for learning, experimenting, and staying ahead of evolving threats—especially those targeting cloud-native and AI systems.

Full-Time Employee Benefits Include:

💰 Competitive Salary & Equity

🩼 Short Term and Long Term Disability

🏝 Flexible Time Off (FTO) + Holidays

🚗 Commuter Benefits (In-Office Only)

📱 Monthly Wellness Stipend

🧑💻 Autonomous Work Environment

🚀 Quarterly Team Gatherings

☕ In Office Amenities (In-Office Only)

• Meet the Replit Agent
• Replit: Make an app for that
• Replit Blog
• Amjad TED Talk

Interviewing + Culture at Replit

• Operating Principles
• Reasons not to work at Replit