Engineering Manager, Security (Cloud, Infrastructure & Application Security)

Replit is hiring an Engineering Manager for Security focused on cloud, infrastructure, and application security, with a strong emphasis on driving vulnerability remediation on time. This role leads security teams responsible for Secure SDLC execution and developer enablement, ensuring findings move through clear ownership, workflows, and SLAs while supporting compliance commitments.

What You’ll Do

• Manage two closely linked groups: Cloud & Infrastructure Security and Application Security & Secure SDLC.
• Partner with engineering teams to remediate cloud, infrastructure, and code findings within SLA to meet compliance commitments including SOC 2, ISO 27001, PCI DSS, FedRAMP, and customer contracts.
• Hire, grow, and mentor a high-performing security engineering team, owning hiring, career development, and performance management.
• Set strategy and roadmap for vulnerability management from code to cloud, with an approach that makes secure-by-default the easiest path for developers.
• Define multi-year roadmap and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC, balancing risk reduction against developer velocity.
• Establish clear ownership, operating rhythms, and on-call or escalation processes across the team.
• Own remediation SLAs by severity across cloud, infrastructure, containers, and code findings, ensuring alignment to compliance obligations.
• Plan and prioritize remediation with engineering managers and tech leads so fixes land within SLA without stalling roadmaps.
• Run regular remediation reviews covering open findings, SLA burn-down, upcoming SLA breaches, and designated owners.
• Manage the exception and risk-acceptance process, including documentation, compensating controls, expiry dates, and approvals.
• Build automated workflows to route findings to the correct owning team, track them to closure, and escalate when SLAs are at risk.
• Work with Compliance or GRC to produce audit-ready evidence of remediation timeliness and lead the security side of external audits for vulnerability management controls.
• Track and report metrics including SLA attainment, mean time to remediate, backlog age, and exceptions by team and severity.
• Lead infrastructure vulnerability management for cloud workloads, containers, registries, data stores, and platform services, from scanning and contextual risk triage to remediation workflows.
• Oversee configuration hardening and secure baselines across GCP (primary) plus supporting AWS and Azure environments.
• Own strategy for CSPM, KSPM, and DSPM tooling so findings are accurate, prioritized, and actionable.
• Secure critical SaaS platforms through sound configurations, access controls, and integrations.
• Partner with Platform and ML Infrastructure teams to secure multi-tenant and AI infrastructure.
• Own SCA, SAST, and IaC scanning programs end to end, including tool selection, CI/CD integration, rule tuning, noise reduction, and developer experience.
• Drive software supply chain security such as dependency management, SBOMs, artifact signing, and progress through SLSA levels.
• Feed code-scanning findings into the central remediation workflow to route to owning teams and track against SLA.
• Shift IaC security left by catching misconfigurations in pull requests before production.
• Define and run the Secure SDLC program including security requirements, threat modeling, secure design reviews, and risk-proportionate release gates.
• Build and deliver security training, including onboarding, role-based secure coding training, and targeted sessions driven by real vulnerability trends.
• Develop paved roads, secure defaults, and guardrails that support engineers adopting secure practices.
• Grow a Security Champions network across engineering teams.
• Support incident response with cloud-native lifecycle context, including asset, exposure, and vulnerability context, and assist with blast radius assessment.
• Own follow-up remediation from incidents and postmortems that touch cloud, infrastructure, or code, tracking issues to closure.
• Feed incident learnings back into scanning rules, secure baselines, and developer training.
• Collaborate with Security Monitoring and Detection, Incident Response, Offensive Security, PSIRT, Architecture, DevOps, and Platform Engineering.
• Help communicate security advisories, best practices, and updates to customers.
• Tune into threat intelligence alerts to manage patching of critical, exploitable vulnerabilities promptly.

What You Bring

• 8+ years in security engineering, cloud security, or DevSecOps, including 2+ years managing security engineers (or 3+ years as a tech lead with formal people-leadership responsibility).
• Deep hands-on knowledge of cloud security in GCP plus working knowledge of AWS and/or Azure, including IAM, networking, logging, org policies, and security services.
• Proven experience running vulnerability management programs at scale and driving remediation across many engineering teams to meet SLAs across cloud infrastructure, containers, and application code.
• Hands-on experience with CSPM/CNAPP platforms (e.g., Wiz, Orca, Prisma Cloud, Lacework, GCP Security Command Center).
• Hands-on experience with SCA, SAST, and IaC scanning tools (e.g., Snyk, Semgrep, CodeQL, Checkmarx, Socket, Dependabot, Checkov, tfsec) and integrating them into CI/CD.
• Strong understanding of Kubernetes and container security, and Infrastructure-as-Code (e.g., Terraform).
• Track record of building or maturing a Secure SDLC program, including developer security training.
• Ability to write and review code or automation (Python, Go, TypeScript, or similar).
• Strong understanding of how remediation SLAs and security controls map to compliance frameworks (SOC 2, ISO 27001, PCI DSS, FedRAMP, CIS, NIST) and experience producing audit evidence.
• Working understanding of security incident response in cloud-native environments to partner effectively with IR and detection teams.
• Excellent communication skills to influence engineering leaders and explain risk in business terms.

Technologies

• Cloud and platforms: GCP, AWS, Azure, Kubernetes
• CSPM/KSPM/DSPM: CSPM, KSPM, DSPM (including Wiz, Orca, Prisma Cloud, Lacework, GCP Security Command Center)
• Scanning and security tooling: SCA, SAST, IaC (Snyk, Semgrep, CodeQL, Checkmarx, Socket, Dependabot, Checkov, tfsec), CI/CD
• Infrastructure and supply chain: Terraform, Python, Go, TypeScript, SLSA, SBOMs, artifact signing

Compensation and Location

• Location: Foster City, CA (onsite)
• Salary: USD 250,000 - 387,000 per year

Benefits

• Competitive Salary & Equity
• 401(k) Program with a 4% match (US Only)
• Health, Dental, Vision and Life Insurance
• Short Term and Long Term Disability
• Paid Parental, Medical, Caregiver Leave
• Flexible Time Off (FTO) + Holidays
• Commuter Benefits (In-Office & US Only)
• Monthly Wellness Stipend
• Autonomous Work Environment
• In Office Set-Up Reimbursement (In-Office Only)
• Quarterly Team Gatherings
• In Office Amenities (In-Office Only)

Bonus Qualifications

• Experience securing developer platforms, multi-tenant SaaS, or AI/ML infrastructure.
• Experience with software supply chain frameworks (SLSA, Sigstore, SBOM standards).
• Experience building a Security Champions program or developer-facing security tooling.
• Experience leading the security side of external audits (SOC 2 Type II, ISO 27001, PCI DSS, or FedRAMP).
• Relevant certifications (e.g., CCSP, GCP Professional Cloud Security Engineer, OSCP, CSSLP), though not required.