Senior Detection & Response Engineer — Automation & Threat Hunting

Rippling; Austin (TX); On-site; USD 151,000 - 280,000; Full time

Job summary

Rippling in Austin, TX is seeking a hands-on Senior Detection and Response Security Engineer to advance our security program through automation, data collection, and advanced detection logic.

You will collaborate with the security team and broader engineering org to elevate detection capabilities, develop runbooks, and lead threat hunting initiatives across cloud production systems. A strong background in SIEM, SOAR, and forensics is required.

Qualifications

• 4+ years of full-time experience as a security engineer focusing on monitoring, incident response, and threat hunting.
• Proficiency in tool development and automation using DevOps toolsets, preferably Python.
• Strong knowledge of attacks, adversary TTPs, and MITRE ATT&CK.
• Experience with large-scale data analysis, modeling, and correlation.
• Cross-platform forensics on macOS, Windows, and Linux.
• Experience with current SIEM and SOAR platforms.
• Log analysis of endpoint, network, and application logs.

Responsibilities

• Design and implement tools to gather security telemetry data from cloud production systems.
• Automate workflows to speed up detection and response.
• Develop and refine advanced detection rules against evolving threats.
• Improve processes and technologies used for detection and response.
• Spearhead SIEM, Case Management, and Automation framework enhancements.
• Create runbooks and incident playbooks for detections.
• Lead threat hunting initiatives and integrate findings into security controls.

Skills

Python

Threat hunting

SIEM/SOAR

Log analysis

Forensics

Data analysis

MITRE ATT&CK

Cross-Platform forensics

Tools

SIEM

SOAR

Job description

Rippling in Austin, TX is seeking a hands-on Senior Detection and Response Security Engineer to advance our security program through automation, data collection, and advanced detection logic.

You will collaborate with the security team and broader engineering org to elevate detection capabilities, develop runbooks, and lead threat hunting initiatives across cloud production systems. A strong background in SIEM, SOAR, and forensics is required.