Rippling, a leading platform for HR, IT, and Finance, is seeking a seasoned Senior Security Engineer to join its Detection and Response Team (DART). This pivotal role focuses on establishing a best-in-class incident response capability. You will be instrumental in navigating complex security incidents, driving continuous process enhancements, and fostering an environment of learning from organizational mistakes. The position also involves developing the essential tools and detection infrastructure to effectively scale our response capabilities across both Production and Corporate environments.

Rippling offers a unified system for managing the entire employee lifecycle, from hiring and onboarding to payroll and benefits. With a strong backing from top investors and recognition from Forbes, Rippling is at the forefront of innovation in business operations technology.

As a Senior Security Engineer on the DART team, you will be responsible for responding to and triaging security events, conducting thorough investigations, and performing detailed incident analysis. Effective and clear communication with stakeholders is paramount.

You will actively contribute to refining the processes, procedures, and technologies utilized for detection and response, ensuring we learn and improve after each incident. This includes developing and deploying tools to collect vital security telemetry data from cloud production systems. Automation of workflows will be key to enhancing identification and response times for security events.

Furthermore, you will build and optimize robust detection rules to focus efforts on the most critical alerts. Developing comprehensive runbooks and incident playbooks for both new and existing detections is also a core responsibility. Leading proactive threat hunting practices, identifying product and infrastructure signals that reveal attacks, and integrating these findings into our security controls will be crucial.

This role requires a minimum of 7 years of full-time experience as a security engineer, with a strong background in security monitoring, incident response, and threat hunting within cloud environments. Candidates must be defensive practitioners with a solid understanding of offensive security principles and the actual scenarios that lead to system compromise.

Prior experience leading complex investigations involving numerous stakeholders is essential. Exceptional communication skills and a proven ability to interact effectively with internal and external stakeholders at all levels are also critical. Expertise in AWS security controls and services is a must, alongside experience leveraging coding for automation, alert enrichment, and detection development.

Knowledge of adversary tactics, techniques, and procedures (TTPs) and MITRE ATT&CK principles is required. Hands-on experience with data analysis, modeling, and correlation at scale, as well as operating system internals and forensics for macOS, Windows, and Linux, are necessary. Familiarity with current SIEM and SOAR platforms, and experience developing tools and automation using common DevOps toolsets and programming languages are also expected. A strong understanding of malware functionality and persistence mechanisms, along with the ability to analyze endpoint, network, and application logs for anomalous events, will be vital for success in this role.