Senior Security Engineer: Detections, IR & Automation

Ripple; San Francisco (CA); Hybrid; USD 172,000 - 215,000; Full time

Benefits offered by this job

Equity

Wellness programs

Vacation policy

Job summary

Ripple, a leading fintech company, is seeking a Senior Security Engineer for its Security Operations team in California. You will design detections, lead incident response, and build automation to scale threat detection and response across our environment.

The role emphasizes collaboration with IT, engineering, and other Ripple teams, with hands-on SIEM and security tooling experience. You will mentor engineers, influence security initiatives, and stay ahead of threat trends, using tools like

Qualifications

• 5+ years of experience in security operations, detection engineering, or incident response.
• Advanced knowledge of security principles, tools, and practices used in detection and response operations.
• Strong scripting/automation skills (Python or SOAR) — comfortable building and maintaining automation for response workflows and working with REST APIs to connect security tools.
• Experience with SIEM platforms and security data pipelines (e.g., Google SecOps) — you understand log source onboarding, parsing, and alert tuning, not just querying.
• Hands‑on experience with EDR, identity, email security, and network security tooling at a level where you can extend and tune the tooling, not just operate it.
• Ability to write clean technical specs, identify risks before starting major projects, and reason clearly about trade‑offs between alternative approaches.
• Problem‑solving skills to resolve ambiguous or high‑pressure situations effectively and creatively, while maintaining flexibility, professionalism, and integrity.
• Understands and anticipates people's needs, skills, and abilities, to coach, motivate, and empower them for success.

Responsibilities

• Design, build, and tune detections across our security stack to improve our ability to identify and mitigate threats.
• Lead incident response for sophisticated and high-severity investigations, from initial triage through root cause and remediation.
• Build and maintain security automation workflows (e.g., in Tines) that reduce manual toil in detection, triage, and response.
• Own and improve SIEM/data pipeline health, including log source coverage, parsing, normalization, and alert quality.
• Develop cross-functional relationships to influence security initiatives and drive adoption of security tooling.
• Maintain awareness of the evolving threat landscape and translate that awareness into concrete improvements to our detection coverage and response playbooks.
• Use AI tools as agentic coding tools for detection engineering and automation work — while verifying output before it ships.
• Mentor and provide technical guidance to less experienced engineers.

Skills

Security Operations

Detection Engineering

Incident Response

Python

SOAR

REST APIs

SIEM

EDR & Identity

Security Automation

Tools

Tines

Google SecOps

EDR tooling

Job description

Ripple, a leading fintech company, is seeking a Senior Security Engineer for its Security Operations team in California. You will design detections, lead incident response, and build automation to scale threat detection and response across our environment.

The role emphasizes collaboration with IT, engineering, and other Ripple teams, with hands-on SIEM and security tooling experience. You will mentor engineers, influence security initiatives, and stay ahead of threat trends, using tools like