{"id":4003738,"url":"https://alion.io/job/replit-engineering-manager-security-cloud-infrastructure-application-security","title":"Engineering Manager, Security (Cloud, Infrastructure & Application Security)","company":{"id":2425,"name":"Replit","domain":"replit.com","url":"https://alion.io/company/replit","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"B","score":84,"open_postings":21,"ghost_share":0.048,"stale_share":0.286,"repost_share":0.048,"time_to_fill_p50_days":77,"computed_at":"2026-11-09T06:03:00Z"}},"role":"Leadership","role_family":"Leadership","seniority":"lead","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Foster City, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":250000,"max":387000,"currency":"USD","period":"year","gross":null,"usd_annual":387000},"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Checkmarx","optional":false},{"name":"Checkov","optional":false},{"name":"CI/CD","optional":false},{"name":"CodeQL","optional":false},{"name":"Dependabot","optional":false},{"name":"FedRAMP","optional":false},{"name":"GCP","optional":false},{"name":"Go","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Lacework","optional":false},{"name":"PCI DSS","optional":false},{"name":"Platform Engineering","optional":false},{"name":"Prisma Cloud","optional":false},{"name":"Python","optional":false},{"name":"Replit","optional":false},{"name":"SBOM","optional":false},{"name":"Semgrep","optional":false},{"name":"Sigstore","optional":false},{"name":"SLSA","optional":false},{"name":"Snyk","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"tfsec","optional":false},{"name":"Threat Modeling","optional":false},{"name":"TypeScript","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-11-10T01:10:02Z","employer_posted_date":"2026-11-10","last_verified_at":"2026-11-10T05:39:30Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.\nAbout the role:\nWe are looking for an Engineering Manager, Security to lead the teams that secure our cloud, our infrastructure, and the code we ship. You will manage two closely linked groups:\nCloud & Infrastructure Security: engineers who own cloud security posture, configuration hardening, and infrastructure vulnerability management across GCP, AWS, and Azure, plus containers, Kubernetes, and SaaS platforms.\n\nApplication Security & Secure SDLC: engineers who run our SCA, SAST, and IaC scanning programs, drive remediation with engineering teams, and deliver secure development training.\n\nThe core responsibility of this role is getting vulnerabilities fixed on time. You will partner with engineering teams across the company to drive remediation of cloud, infrastructure, and code findings within SLA, so that we consistently meet our compliance commitments (SOC 2, ISO 27001, PCI DSS, FedRAMP, and customer contracts). You will hire and grow a high-performing team, set the strategy and roadmap for vulnerability management from code to cloud, and make secure-by-default the easiest path for every developer. You will not run incident response yourself, but you need to understand it well enough to support the incident response team with context, prioritization, and follow-up fixes.\nWhat You'll Do:\nTeam Leadership & Strategy\nBuild, lead, and mentor a team of cloud security, infrastructure vulnerability management, and application security engineers; own hiring, career development, and performance management.\n\nDefine the multi-year roadmap and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC, balancing risk reduction against developer velocity.\n\nSet clear ownership, operating rhythms, and on-call/escalation processes across the team.\n\nReport on security posture, risk trends, and program metrics to engineering and executive leadership.\n\nRemediation & Compliance Delivery\nOwn remediation SLAs by severity across cloud, infrastructure, container, and code findings, and make sure they map to our compliance obligations (SOC 2, ISO 27001, PCI DSS, FedRAMP, customer contracts).\n\nPartner with engineering managers and tech leads to plan, prioritize, and land fixes within SLA without stalling roadmaps.\n\nRun a regular remediation review with engineering leadership: open findings, SLA burn-down, upcoming SLA breaches, and owners.\n\nManage the exception and risk-acceptance process: documented justification, compensating controls, expiry dates, and approvals.\n\nBuild automated workflows that route findings to the right owning team, track them to closure, and escalate before SLAs are breached.\n\nWork with Compliance/GRC to produce audit-ready evidence of remediation timeliness, and lead the security side of external audits for vulnerability management controls.\n\nTrack and report metrics such as SLA attainment, mean time to remediate, backlog age, and exceptions, by team and severity.\n\nCloud & Infrastructure Security\nLead infrastructure vulnerability management across cloud workloads, containers, registries, data stores, and platform services, from scanning and contextual risk triage to remediation workflows.\n\nOversee configuration hardening and secure baselines across GCP (primary) and supporting AWS and Azure environments.\n\nOwn the strategy for Cloud, Kubernetes, and Data Security Posture Management (CSPM, KSPM, DSPM) tooling; make sure findings are accurate, prioritized, and actionable.\n\nSecure critical SaaS platforms with sound configurations, access controls, and integrations.\n\nPartner with Platform and ML Infrastructure teams to secure multi-tenant and AI infrastructure.\n\nApplication Security & Code Scanning\nOwn the SCA, SAST, and IaC scanning programs end to end: tool selection, CI/CD integration, rule tuning, noise reduction, and developer experience.\n\nDrive software supply chain security, including dependency management, SBOMs, artifact signing, and progress through SLSA levels.\n\nFeed code-scanning findings into the central remediation workflow so they reach the owning team automatically and are tracked against SLA.\n\nShift IaC security left so misconfigurations are caught in pull requests, before they reach production.\n\nSecure SDLC & Developer Enablement\nDefine and run the Secure SDLC program: security requirements, threat modeling, secure design reviews, and release gates proportionate to risk.\n\nBuild and deliver security training, including onboarding, role-based secure coding training, and targeted sessions driven by real vulnerability trends.\n\nDevelop paved roads, secure defaults, and guardrails that make the secure path the easiest path for engineers.\n\nGrow a Security Champions network across engineering teams.\n\nIncident Response Partnership & Collaboration\nUnderstand the incident response lifecycle well enough to support the IR team: supply asset, exposure, and vulnerability context, and help assess blast radius.\n\nOwn follow-up remediation from incidents and postmortems that touch cloud, infrastructure, or code, and track it to closure.\n\nFeed incident learnings back into scanning rules, secure baselines, and developer training.\n\nCollaborate with Security Monitoring/Detection, Incident Response, Offensive Security, PSIRT, Architecture, DevOps, and Platform Engineering.\n\nHelp communicate security advisories, best practices, and updates to customers.\n\nTune into threat intelligence alerts to promptly manage patching of critical, exploitable vulnerabilities.\n\nRequired Skills & Experience:\n8+ years in security engineering, cloud security, or DevSecOps, including 2+ years managing security engineers (or 3+ years as a tech lead with formal people-leadership responsibility).\n\nDeep, hands-on knowledge of cloud security in GCP plus working knowledge of AWS and/or Azure: IAM, networking, logging, org policies, and security services.\n\nProven track record running vulnerability management programs at scale and driving remediation across many engineering teams to meet SLAs, across cloud infrastructure, containers, and application code.\n\nHands-on experience with CSPM/CNAPP platforms (e.g., Wiz, Orca, Prisma Cloud, Lacework, GCP Security Command Center).\n\nHands-on experience with SCA, SAST, and IaC scanning tools (e.g., Snyk, Semgrep, CodeQL, Checkmarx, Socket, Dependabot, Checkov, tfsec) and integrating them into CI/CD.\n\nStrong understanding of Kubernetes and container security, and Infrastructure-as-Code (Terraform or similar).\n\nProven track record of building or maturing a Secure SDLC program, including developer security training.\n\nAbility to write and review code or automation (Python, Go, TypeScript, or similar).\n\nStrong understanding of how remediation SLAs and security controls map to compliance frameworks (SOC 2, ISO 27001, PCI DSS, FedRAMP, CIS, NIST), and experience producing audit evidence.\n\nWorking understanding of security incident response in cloud-native environments, enough to partner effectively with IR and detection teams.\n\nExcellent communication skills, with the ability to influence engineering leaders and explain risk in business terms.\n\nBonus Qualifications:\nExperience securing developer platforms, multi-tenant SaaS, or AI/ML infrastructure.\n\nExperience with software supply chain frameworks (SLSA, Sigstore, SBOM standards).\n\nExperience building a Security Champions program or developer-facing security tooling.\n\nExperience leading the security side of external audits (SOC 2 Type II, ISO 27001, PCI DSS, or FedRAMP).\n\nRelevant certifications (e.g., CCSP, GCP Professional Cloud Security Engineer, OSCP, CSSLP), though not required.\n\nFull-Time Employee Benefits Include:\nCompetitive Salary & Equity\n401(k) Program with a 4% match (US Only)\nHealth, Dental, Vision and Life Insurance\nShort Term and Long Term Disability\nPaid Parental, Medical, Caregiver Leave\nFlexible Time Off (FTO) + Holidays\nCommuter Benefits (In-Office & US Only)\nMonthly Wellness Stipend\nAutonomous Work Environment\nIn Office Set-Up Reimbursement (In-Office Only)\nQuarterly Team Gatherings\nIn Office Amenities (In-Office Only)\nWant to learn more about what we are up to?\nSelf-driving Company\n\nReplit Agent at Scale\n\nAI Adoption\n\nBuild Open-Source Apps\n\nInterviewing + Culture at Replit\nOperating Principles\n\nReasons not to work at Replit\n\nTo achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.","description_format":"text","description_chars":8873,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Flexible time off","Life insurance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Application Security","Code Intelligence","AI Development Tools","Website Builders"],"lifecycle":[{"event":"open","at":"2026-11-10T05:39:30Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 29 · green card filings: 1","filings_12m":29,"filings_prev_12m":5,"green_card_filings_12m":1,"median_offered_wage_usd":201833,"route":null,"cap_exempt":false,"checked_at":"2026-11-09T07:32:21+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":77,"reasons":["conf:1","win:early"],"computed_at":"2026-11-10T06:50:08Z"},"pay":{"stated_usd_annual":387000,"is_top_pay":true},"html_url":"https://alion.io/job/replit-engineering-manager-security-cloud-infrastructure-application-security","json_url":"https://alion.io/job/replit-engineering-manager-security-cloud-infrastructure-application-security.json","meta":{"generated_at":"2026-11-10T06:50:08Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":15895,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-11T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":2425},"rest":"https://alion.io/mcp/rest/get_company?id=2425"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Freplit-engineering-manager-security-cloud-infrastructure-application-security"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Freplit-engineering-manager-security-cloud-infrastructure-application-security"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Freplit-engineering-manager-security-cloud-infrastructure-application-security"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/replit-engineering-manager-security-cloud-infrastructure-application-security\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Freplit-engineering-manager-security-cloud-infrastructure-application-security"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4003738}},{"tool":"search_jobs","arguments":{"company":"replit.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4003738},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}