Lead Security Incident Response Engineer

Ripple; San Francisco (CA); On-site; USD 172,000 - 215,000; Full time

Job summary

Ripple is building a security‑first culture in San Francisco. We seek a Security Engineer/Incident Response lead to design, build, and run detections across our security stack, identifying threats and driving improvements.

You will own high‑severity incident response, create automation with Tines, and partner with IT and engineering to fortify defenses. You’ll mentor teammates, influence security initiatives, and stay ahead of evolving threats while collaborating with cross‑functional teams to

Qualifications

• 5+ years of experience in security operations, detection engineering, or incident response.
• Advanced knowledge of security principles, tools, and practices.
• Strong scripting/automation skills (Python or SOAR) with REST API work.
• Experience with SIEM platforms and security data pipelines.
• Hands-on experience with EDR, identity, email security, and network tooling.
• Ability to write clean technical specs and assess risks.
• Problem-solving skills to resolve high-pressure situations.
• Ability to coach and empower teammates.

Responsibilities

• Design, build, and tune detections across our security stack to improve threat identification and mitigation.
• Lead incident response for sophisticated and high-severity investigations, from triage to root cause and remediation.
• Build and maintain security automation workflows (e.g., in Tines)
• Own and improve SIEM/data pipeline health, including log source coverage, parsing/normalization, and alert quality.
• Develop cross-functional relationships to influence security initiatives and drive tooling adoption.
• Maintain awareness of evolving threat landscape and translate into improvements to detection coverage and playbooks.
• Use AI tools like Claude Code or OpenAI Codex for detection engineering and automation work, verifying output before it ships.
• Mentor and provide technical guidance to less experienced engineers.

Skills

Security ops

Security principles

Scripting/Automation

SIEM & data pipelines

EDR & IAM

Tech specs writing

Problem solving

Coaching

Tools

Tines

Google SecOps

Job description

Ripple is building a security‑first culture in San Francisco. We seek a Security Engineer/Incident Response lead to design, build, and run detections across our security stack, identifying threats and driving improvements.

You will own high‑severity incident response, create automation with Tines, and partner with IT and engineering to fortify defenses. You’ll mentor teammates, influence security initiatives, and stay ahead of evolving threats while collaborating with cross‑functional teams to