Join Rippling's Detection and Response Team (DART) as a Staff Security Engineer to build a world-class incident response function. This role is pivotal in navigating complex security incidents, enhancing operational processes, and fostering a culture of continuous improvement. You will also be instrumental in developing the tools and detection infrastructure necessary to scale our response capabilities across all threats to our production and corporate environments.

Rippling offers a unified platform for HR, IT, and Finance, streamlining employee lifecycle management from hiring to offboarding. Based in San Francisco, CA, we are backed by top investors and recognized as a leading startup employer.

Respond to and investigate security events, providing clear and efficient communication to stakeholders throughout the process. Drive improvements in detection and response processes, technologies, and procedures to learn from each incident.

Develop and deploy tools for gathering security telemetry from cloud production systems. Automate workflows to enhance the speed of identification and response for security events. Build and optimize detection rules to focus on high-priority alerts.

Create runbooks and incident playbooks for new and existing detections. Lead threat hunting initiatives, propose product and infrastructure signals to identify attacks, and integrate findings into security controls.

A seasoned security engineer with over 10 years of full-time experience in security monitoring, incident response, and threat hunting within cloud environments. Possess a deep understanding of offensive security and real-world compromise scenarios from a defensive perspective.

Demonstrated ability to lead complex investigations involving numerous stakeholders. Excellent communication skills are essential for effectively interacting with internal and external parties at all levels.

Expertise in AWS security controls and services. Proficiency in leveraging coding for automation, alert enrichment, and detection development. Familiarity with adversary tactics, techniques, and procedures (TTPs) and MITRE ATT&CK principles.

Hands-on experience with large-scale data analysis, modeling, and correlation. Experience with operating system internals and forensics for macOS, Windows, and Linux. In-depth knowledge of current SIEM and SOAR platforms. Experience developing tools and automation using common DevOps toolsets and programming languages. Understanding of malware functionality and persistence mechanisms. Ability to analyze endpoint, network, and application logs for anomalous events.