Staff Security Engineer - Detection & Incident Lead

Ripple; Greater London; Hybrid; GBP 120,000 - 180,000; Full time

Job summary

Ripple is seeking a Staff Security Engineer to join our Security Operations team. You will design, implement, and tune detections, lead the most complex investigations, and build automation to scale security workflows across our environment.

You will own SIEM pipelines and collaborate with detection engineers and developers, applying AI-assisted tooling while safeguarding alert quality and response integrity.

Qualifications

• 7+ years in security operations, detection engineering, or incident response with end-to-end ownership.
• Advanced knowledge of blue team practices and scripting for automation.
• Experience with SIEM platforms and security data pipelines, including log onboarding and alert tuning.
• Hands-on experience with EDR, identity, email security, and network security tooling.
• Ability to write clear technical specs and reason about trade-offs.
• Ability to break down complex projects into simple, repeatable processes and to give feedback in design reviews.

Responsibilities

• Design, build, and tune detections across the security stack to improve threat identification and mitigation.
• Lead incident response for the most complex investigations from triage through remediation.
• Build and maintain security automation workflows that reduce manual toil in detection, triage, and response.
• Own and improve SIEM/data pipeline health, including log source coverage, parsing, normalization, and alert quality.
• Develop cross-functional relationships to influence security initiatives and drive adoption of security tooling.
• Maintain awareness of evolving threat landscape and translate to concrete improvements to detection coverage and playbooks.
• Use AI tools as more than a chatbot - agentic coding tools for detection engineering and automation work, while verifying output.
• Participate in design reviews, breaking complex challenges into simple systems that others can build and maintain.

Skills

Security operations

Incident response

Detection engineering

Scripting

SIEM

EDR / Identity / Network security

Technical specs

Project breakdown

Coaching & feedback

Tools

Google SecOps

Tines

Claude Code

OpenAI Codex

Job description

Ripple is seeking a Staff Security Engineer to join our Security Operations team. You will design, implement, and tune detections, lead the most complex investigations, and build automation to scale security workflows across our environment.

You will own SIEM pipelines and collaborate with detection engineers and developers, applying AI-assisted tooling while safeguarding alert quality and response integrity.