Staff Security Engineer — AI-Driven Detection & Response

Ridgeline; San Ramon (CA); On-site; USD 205,000 - 256,000; Full time

Benefits offered by this job

Unlimited vacation

Job summary

Ridgeline is seeking a Staff Security Engineer - Detection and Response (L4) to lead the DART roadmap and architect AI-augmented detection and response systems across AWS and related platforms. You will own incident response maturity, drive secure detection design, and mentor engineers in a fast-growing cloud investment management platform.

Location includes San Ramon, CA and Reno, NV, with a culture of ownership, transparency, and action.

Qualifications

• 8+ years in detection, security or IR with cross-functional leadership.
• Proficiency in Python (preferred) or Kotlin/TypeScript.
• Experience engineering AI/LLM-driven detection, triage, and investigation workflows.
• Detections mapped to attacker TTPs (MITRE ATT&CK).
• Experience building detection-as-code and alerting pipelines.

Responsibilities

• Shape the DART roadmap based on business priorities and threat models.
• Close detection gaps by variant analysis to cover entire classes of vulnerabilities.
• Architect AI-powered detection and triage pipelines with reduced false positives.
• Collaborate on SIEM/SOAR and related security platforms.
• Own incident response program architecture and leadership during major incidents.
• Set technical direction for DART codebases and infrastructure.
• Establish AI usage guardrails and responsible AI practices.
• Influence security strategy across engineering through technical credibility.
• Mentor junior engineers and promote knowledge sharing.

Skills

Cross-functional leadership

Python

AI/LLM-driven systems

MITRE ATT&CK mappings

Detections-as-code

AWS ecosystem

Terraform

CI/CD

Communication

Tools

AWS

CloudWatch

Athena

Job description

Ridgeline is seeking a Staff Security Engineer - Detection and Response (L4) to lead the DART roadmap and architect AI-augmented detection and response systems across AWS and related platforms. You will own incident response maturity, drive secure detection design, and mentor engineers in a fast-growing cloud investment management platform.

Location includes San Ramon, CA and Reno, NV, with a culture of ownership, transparency, and action.