Engineering Manager, Security (Cloud, Infrastructure & Application Security)

Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. About the role: We are looking for an Engineering Manager, Security to lead the teams that secure our cloud, our infrastructure, and the code we ship. You will manage two closely linked groups: Cloud & Infrastructure Security : engineers who own cloud security posture, configuration hardening, and infrastructure vulnerability management across GCP, AWS, and Azure, plus containers, Kubernetes, and SaaS platforms. Application Security & Secure SDLC : engineers who run our SCA, SAST, and IaC scanning programs, drive remediation with engineering teams, and deliver secure development training. The core responsibility of this role is getting vulnerabilities fixed on time . You will partner with engineering teams across the company to drive remediation of cloud, infrastructure, and code findings within SLA, so that we consistently meet our compliance commitments (SOC 2, ISO 27001, PCI DSS, FedRAMP, and customer contracts). You will hire and grow a high-performing team, set the strategy and roadmap for vulnerability management from code to cloud, and make secure-by-default the easiest path for every developer. You will not run incident response yourself, but you need to understand it well enough to support the incident response team with context, prioritization, and follow-up fixes.   What You'll Do: Team Leadership & Strategy Build, lead, and mentor a team of cloud security, infrastructure vulnerability management, and application security engineers; own hiring, career development, and performance management. Define the multi-year roadmap and quarterly OKRs for cloud security, vulnerability management, and Secure SDLC, balancing risk reduction against developer velocity. Set clear ownership, operating rhythms, and on-call/escalation processes across the team. Report on security posture, risk trends, and program metrics to engineering and executive leadership. Remediation & Compliance Delivery Own remediation SLAs by severity across cloud, infrastructure, container, and code findings, and make sure they map to our compliance obligations (SOC 2, ISO 27001, PCI DSS, FedRAMP, customer contracts). Partner with engineering managers and tech leads to plan, prioritize, and land fixes within SLA without stalling roadmaps. Run a regular remediation review with engineering leadership: open findings, SLA burn-down, upcoming SLA breaches, and owners. Manage the exception and risk-acceptance process: documented justification, compensating controls, expiry dates, and approvals. Build automated workflows that route findings to the right owning team, track them to closure, and escalate before SLAs are breached. Work with Compliance/GRC to produce audit-ready evidence of remediation timeliness, and lead the security side of external audits for vulnerability management controls. Track and report metrics such as SLA attainment, mean time to remediate, backlog age, and exceptions, by team and severity. Cloud & Infrastructure Security Lead infrastructure vulnerability management across cloud workloads, containers, registries, data stores, and platform services, from scanning and contextual risk triage to remediation workflows. Oversee configuration hardening and secure baselines across GCP (primary) and supporting AWS and Azure environments. Own the strategy for Cloud, Kubernetes, and Data Security Posture Management (CSPM, KSPM, DSPM) tooling; make sure findings are accurate, prioritized, and actionable. Secure critical SaaS platforms with sound configurations, access controls, and integrations. Partner with Platform and ML Infrastructure teams to secure multi-tenant and AI infrastructure. Application Security & Code Scanning Own the SCA, SAST, and IaC sca