Staff Security Engineer

As a Staff Security Engineer on Ripple's Security Operations team, you help detect, investigate, and respond to security threats across the company's environment. You'll work across detection and data engineering, incident response, and security automation, building the tooling and detection logic that lets the team scale. You operate independently on sophisticated investigations and serve as a technical reference point for less senior engineers.

What you'll do

• Design, build, and tune detections across the security stack (Google Security Operations) to identify and mitigate threats.
• Lead incident response for the most complex and high-severity investigations, from initial triage through root cause and remediation.
• Build and maintain security automation workflows (e.g., in Tines) that reduce manual toil in detection, triage, and response.
• Own and improve SIEM/data pipeline health, including log source coverage, parsing/normalization, and alert quality.
• Develop cross-functional relationships to influence security initiatives and drive adoption of security tooling.
• Maintain awareness of the evolving threat landscape and translate that awareness into concrete improvements to detection coverage and response playbooks.
• Use AI tools for detection engineering and automation work, such as agentic coding tools like Claude Code or OpenAI Codex, while knowing when a given tool is the right fit and verifying output before it ships.
• Participate in the design review process, giving and receiving constructive feedback to keep detection and automation projects on track, and break complex detection challenges into simple systems other engineers can build and maintain.

What you bring

• 7+ years of experience in security operations, detection engineering, or incident response, with a track record of owning incident response and detection work end-to-end.
• Advanced knowledge of security principles, tools, and practices used in blue teaming operations, with advanced proficiency in at least one scripting language for response automation and REST APIs to automate security operations work.
• Experience with SIEM platforms and security data pipelines (e.g., Google SecOps), including log source onboarding, parsing, and alert tuning, not just querying.
• Hands-on experience with EDR, identity, email security, and network security tooling at a level where you can extend and tune the tooling, not just operate it.
• Ability to write clean technical specs, identify risks before starting major projects, and reason clearly about trade-offs between alternative approaches.
• Ability to break down complex projects into simple systems and repeatable processes that other engineers can build and maintain, and to seek and give constructive feedback in design review.
• Problem-solving skills to resolve ambiguous or high-pressure situations effectively and creatively, while maintaining flexibility, professionalism, and integrity.
• Ability to understand and anticipate people's needs, skills, and abilities to coach, motivate, and empower them for success.

What we offer

• Competitive salary, bonuses, and equity
• Competitive benefits covering physical and mental healthcare, retirement, family forming, and family support
• Professional development budget
• R&R days to rest and recharge
• Generous wellness reimbursement and weekly onsite and virtual programming
• Generous vacation policy to take time off when you need it
• Industry-leading parental leave policies and family planning benefits
• Employee giving match
• Mobile phone stipend
• Flexible in-office collaboration (10+ days a month, decided by managers and teams)
• Catered lunches, fully-stocked kitchens, and team events

About Ripple

Ripple builds crypto solutions for financial institutions, businesses, governments, and developers to improve the global financial system. The company is creating greater economic fairness and opportunity for more people across the world.