Staff Security Engineer

As a Staff Security Engineer on Ripple's Security Operations team, you help detect, investigate, and respond to security threats across the company's environment. You work across detection and data engineering, incident response, and security automation, building the tooling and detection logic that lets the team scale. You operate independently on sophisticated investigations and detection initiatives, and serve as a technical reference point for less senior engineers.

What you'll do

• Design, build, and tune detections across the security stack (Google Security Operations) to improve your ability to identify and mitigate threats.
• Lead incident response for the most complex and high-severity investigations, from initial triage through root cause and remediation.
• Build and maintain security automation workflows (for example, in Tines) that reduce manual toil in detection, triage, and response.
• Own and improve SIEM and data pipeline health, including log source coverage, parsing and normalization, and alert quality.
• Develop cross-functional relationships to influence security initiatives and drive adoption of security tooling.
• Maintain awareness of the evolving threat landscape and translate that awareness into concrete improvements to detection coverage and response playbooks.
• Use AI tools effectively as more than a chatbot, including agentic coding tools like Claude Code or OpenAI Codex for detection engineering and automation work, while knowing when a given tool is the right fit and verifying output before it ships.
• Participate in the design review process, giving and receiving constructive feedback to keep detection and automation projects on track, and break complex detection challenges into simple systems and repeatable processes other engineers can build and maintain.

What you bring

• 7+ years of experience in security operations, detection engineering, or incident response, with a track record of owning incident response and detection work end-to-end.
• Advanced knowledge of security principles, tools, and practices used in blue teaming operations, with advanced proficiency in at least one scripting language for tasks such as response automation and using REST APIs to automate security operations work.
• Experience with SIEM platforms and security data pipelines (for example, Google SecOps), understanding log source onboarding, parsing, and alert tuning, not just querying.
• Hands-on experience with EDR, identity, email security, and network security tooling at a level where you can extend and tune the tooling, not just operate it.
• Ability to write clean technical specs, identify risks before starting major projects, and reason clearly about trade-offs between alternative approaches.
• Ability to break down complex projects into simple systems and repeatable processes that other engineers can build and maintain, and to seek and give constructive feedback in design review.
• Problem-solving skills to resolve ambiguous or high-pressure situations effectively and creatively, while maintaining flexibility, professionalism, and integrity.
• Understanding of and ability to anticipate people's needs, skills, and abilities, to coach, motivate, and empower them for success.

What we offer

• Competitive salary, bonuses, and equity
• Competitive benefits covering physical and mental healthcare, retirement, family forming, and family support
• Professional development budget to support learning
• In-office collaboration with flexibility for managers and teams to decide which 10+ days a month they come in
• R&R days to rest and recharge
• Generous wellness reimbursement and weekly onsite and virtual programming
• Generous vacation policy to take time off when you need it
• Industry-leading parental leave policies and family planning benefits
• Employee giving match
• Mobile phone stipend
• Catered lunches, fully-stocked kitchens, and team offsites and bonding activities

About Ripple

Ripple builds crypto solutions for financial institutions, businesses, governments, and developers to improve the global financial system. The company operates in a fast-paced environment with experienced industry leaders and a focus on creating economic fairness and opportunity worldwide.