Senior Security Architect - MSSP Platform & Cloud Security

Rippling, Inc.; United States; Remote; USD 180,000 - 240,000; Full time

Job summary

Bespin Global US delivers managed security services, focusing on enterprise-grade SIEM and SOAR pipelines, EDR deployments, and CSPM across cloud environments. You will architect the service platform and act as senior technical voice with customers, scoping engagements, onboarding, and guiding security maturity.

The role centers on designing and operating the security stack, including detection content, playbooks, and secure connectivity, while advising customers and shaping the security program

Qualifications

• 7+ years in security engineering, ops, or consulting with ownership of a SIEM platform.
• Hands-on with at least one modern SIEM - Google SecOps/Chronicle, Elastic, or Coralogix.
• Experience deploying and operating EDR/XDR platforms (SentinelOne, CrowdStrike).
• Experience with CSPM/CNAPP like Wiz, policy baselines, remediation workflows.
• Familiar with SOAR platforms and automation of security workflows.
• Strong cloud security fundamentals across AWS, GCP, or Azure, at least two.
• Scripting/automation skills (Python, PowerShell) and IaC exposure.
• Excellent communication with customers; capable of workshops and escalations.
• Familiarity with MITRE ATT&CK, NIST CSF, CIS Benchmarks, SOC 2

Responsibilities

• Own the architecture and build-out of the multi-tenant SIEM and SOAR environments.
• Design and deploy EDR tooling across customer estates (SentinelOne, CrowdStrike).
• Build and maintain detection content mapped to MITRE ATT&CK; tune to reduce false positives.
• Develop SOAR playbooks for triage, enrichment, containment, notification workflows.
• Engineer log ingestion/normalization across cloud, endpoint, identity, network sources.
• Stand up Wiz for CSPM across AWS, GCP, Azure; define baselines and remediation guidance.
• Design secure connectivity into customer environments (Tailscale); enforce least privilege.
• Automate deployment/configuration via IaC and scripting; avoid manual per-customer work.
• Evaluate new tooling and advise build-vs-buy for the practice.
• Lead technical discovery and scoping for prospective customers; translate risk into service design.
• Own onboarding execution from log source integration to validated detections.
• Serve as escalation point for customers post go-live.
• Conduct security assessments and cloud posture reviews; present remediation roadmaps.
• Partner with sales on solutions and SOWs; produce reference architectures and runbooks.

Skills

SIEM ownership

EDR/XDR tooling

CSPM/CNAPP

SOAR automation

Cloud security

Python/PowerShell

MITRE ATT&CK/NIST

Customer communication

Tools

Google SecOps/Chronicle

Elastic

Coralogix

SentinelOne

CrowdStrike

Wiz

Tailscale

Job description

Bespin Global US delivers managed security services, focusing on enterprise-grade SIEM and SOAR pipelines, EDR deployments, and CSPM across cloud environments. You will architect the service platform and act as senior technical voice with customers, scoping engagements, onboarding, and guiding security maturity.

The role centers on designing and operating the security stack, including detection content, playbooks, and secure connectivity, while advising customers and shaping the security program