Senior Detection & Response Engineer - Automation & SIEM

Rippling; San Francisco (CA); On-site; USD 168,000 - 280,000; Full time

Job summary

Rippling is seeking a hands-on Senior Detection and Response Security Engineer to enhance our security program through automation, data collection, and advanced detection logic. You will partner with the security team and engineering to elevate threat detection and response capabilities.

You will design tools to gather telemetry, automate workflows, and develop sophisticated detection rules while contributing to SIEM and automation initiatives, with a strong emphasis on proactive threat hunting

Qualifications

• Extensive expertise in security monitoring, incident response, and threat hunting.
• Proficiency in developing tools and automation using DevOps tech, with a preference for Python.
• Deep knowledge of ATT&CK techniques and adversary TTPs.
• Analytical experience with large-scale data analysis and correlation.
• Cross-platform forensics across macOS, Windows, and Linux.
• Experience with SIEM and SOAR platforms.
• Strong log analysis of endpoint, network, and application data.

Responsibilities

• Design and implement tools to gather security telemetry from cloud production systems.
• Lead automation of workflows to speed up detection and response.
• Develop and refine detection rules to counter emerging threats.
• Drive improvements in processes, procedures, and technologies for detection and response.
• Advance SIEM, Case Management, and Automation frameworks.
• Create runbooks and incident playbooks for detections.
• Lead proactive threat hunting and integrate findings into controls.

Job description

Rippling is seeking a hands-on Senior Detection and Response Security Engineer to enhance our security program through automation, data collection, and advanced detection logic. You will partner with the security team and engineering to elevate threat detection and response capabilities.

You will design tools to gather telemetry, automate workflows, and develop sophisticated detection rules while contributing to SIEM and automation initiatives, with a strong emphasis on proactive threat hunting