Senior Threat Detection & Response Engineer - Automation

Rippling; New York (NY); Hybrid; USD 170,000 - 250,000; Full time

Job summary

Rippling seeks a hands-on Senior Detection and Response Security Engineer to drive our security program forward. You will collaborate with our security team and broader engineering org to enhance detection and response with automation and data-driven approaches.

You will design sophisticated detection logic, build automation for security events, and refine tools and workflows to protect cloud production systems.

Qualifications

• Minimum 4+ years as a security engineer with focus on monitoring, IR, and threat hunting.
• Proficient in Python tooling and automation.
• Strong knowledge of ATT&CK, threat tactics and incident response workflows.
• Experience with large-scale data analysis, correlation, and forensics across macOS/Windows/Linux.

Responsibilities

• Design and implement security telemetry collection from cloud production systems.
• Automate workflows to speed up threat detection and response.
• Develop and refine detection rules to block emerging threats.
• Improve processes, procedures, and technologies for detection and response.
• Advance SIEM, Case Management, and automation frameworks.
• Create runbooks and incident playbooks for detections.
• Lead proactive threat hunting and integrate findings into controls.

Skills

Security monitoring

Incident response

Threat hunting

Python scripting

Data analysis

Logs correlation

MITRE ATT&CK

Cross-platform forensics

SIEM/SOAR

Education

Bachelor's degree in CS/Info Sec

Tools

Splunk

SOAR platforms

Cloud telemetry tooling

Job description

Rippling seeks a hands-on Senior Detection and Response Security Engineer to drive our security program forward. You will collaborate with our security team and broader engineering org to enhance detection and response with automation and data-driven approaches.

You will design sophisticated detection logic, build automation for security events, and refine tools and workflows to protect cloud production systems.