Senior Security Engineer, Incident Response

As a Senior Security Engineer on Ripple's Security Operations team, you help detect, investigate, and respond to security threats across the company's environment. You work across detection and data engineering, incident response, and security automation, building the tooling and detection logic that lets the team scale. You operate independently on sophisticated investigations and detection initiatives, and serve as a technical reference point for less senior engineers.

What you'll do

• Design, build, and tune detections across the security stack using Google Security Operations to improve threat identification and mitigation.
• Lead incident response for sophisticated and high-severity investigations, from initial triage through root cause analysis and remediation.
• Build and maintain security automation workflows using tools like Tines to reduce manual toil in detection, triage, and response.
• Own and improve SIEM and data pipeline health, including log source coverage, parsing and normalization, and alert quality.
• Develop cross-functional relationships with IT, engineering, and other Ripple teams to influence security initiatives and drive adoption of security tooling.
• Maintain awareness of the evolving threat landscape and translate that into concrete improvements to detection coverage and response playbooks.
• Use AI tools strategically for detection engineering and automation work, such as agentic coding tools like Claude or OpenAI Codex, while knowing when a given tool is the right fit and verifying output before deployment.
• Mentor and provide technical guidance to less experienced engineers.

What you bring

• 5+ years of experience in security operations, detection engineering, or incident response, with a track record of owning incident response and detection work end-to-end.
• Advanced knowledge of security principles, tools, and practices used in detection and response operations.
• Strong scripting and automation skills in Python or SOAR, comfortable building and maintaining automation for response workflows and working with REST APIs to connect security tools.
• Experience with SIEM platforms and security data pipelines such as Google SecOps, understanding log source onboarding, parsing, and alert tuning, not just querying.
• Hands-on experience with EDR, identity, email security, and network security tooling at a level where you can extend and tune the tooling, not just operate it.
• Ability to write clean technical specs, identify risks before starting major projects, and reason clearly about trade-offs between alternative approaches.
• Problem-solving skills to resolve ambiguous or high-pressure situations effectively and creatively while maintaining flexibility, professionalism, and integrity.
• The ability to understand and anticipate people's needs, skills, and abilities in order to coach, motivate, and empower them for success.

What we offer

• Annual base salary of $172,000 to $215,000 USD for positions based in California, plus equity and additional compensation such as bonuses.
• Competitive benefits covering physical and mental healthcare, retirement, family forming, and family support.
• Professional development budget to support learning and growth.
• Rest and recharge days, generous wellness reimbursement, and weekly onsite and virtual wellness programming.
• Generous vacation policy where you work with your manager to take time off when needed.
• Industry-leading parental leave and family planning benefits.
• Employee giving match and mobile phone stipend.
• In-office collaboration flexibility, with teams deciding which 10+ days a month to come in.
• Catered lunches, fully-stocked kitchens with premium snacks and beverages, team offsites, team bonding activities, and company events.

About Ripple

Ripple builds crypto solutions for financial institutions, businesses, governments, and developers to improve the global financial system and create greater economic fairness and opportunity worldwide.