Senior Detection & Response Engineer — Automation & SIEM

Rippling; San Francisco (CA); On-site; USD 170,000 - 210,000; Full time

Benefits offered by this job

Equity

Benefits

Job summary

Rippling in San Francisco seeks a hands-on Senior Detection and Response Security Engineer to advance our security program through automation, data collection, and detection logic. You will build tools, automate workflows, develop detection rules, and improve SIEM/SOAR capabilities while documenting runbooks and incident playbooks.

You will lead threat hunting initiatives, analyze telemetry from cloud production systems, and collaborate with the security and engineering teams to strengthen

Qualifications

• 4+ years of full-time security engineering, focusing on monitoring, incident response, and threat hunting.
• Proficiency in developing automation using Python and DevOps toolchains.
• Strong knowledge of MITRE ATT&CK and adversary TTPs.
• Experience with large-scale data analysis, modeling, and correlation.
• Forensics expertise across macOS, Windows, Linux.

Responsibilities

• Design and implement tools to gather security telemetry from cloud systems.
• Automate security workflows to speed detection and response.
• Develop and refine detection rules for emerging threats.
• Improve SIEM, SOAR, and related detection technologies.
• Create runbooks and incident playbooks for detections.
• Lead proactive threat hunting initiatives.
• Collaborate with security and engineering teams.

Skills

Threat hunting

Security monitoring

Incident response

Python scripting

Data analysis

Tools

SIEM

SOAR

MITRE ATT&CK

Cloud telemetry tooling

Job description

Rippling in San Francisco seeks a hands-on Senior Detection and Response Security Engineer to advance our security program through automation, data collection, and detection logic. You will build tools, automate workflows, develop detection rules, and improve SIEM/SOAR capabilities while documenting runbooks and incident playbooks.

You will lead threat hunting initiatives, analyze telemetry from cloud production systems, and collaborate with the security and engineering teams to strengthen