Senior Security Engineer

Ripple is building financial infrastructure for a connected world, enabling value to move across borders as seamlessly as information does today. The company powers crypto solutions for institutions, businesses, governments, and developers, fundamentally reshaping how the global financial system operates. With a mission to create greater economic opportunity worldwide, Ripple combines bold ambition with a collaborative culture where talented engineers make real impact.

The Security Operations team at Ripple is looking for a Senior Security Engineer to strengthen detection, investigation, and response capabilities across the organization. You'll own sophisticated security initiatives end-to-end, from building detection logic to leading high-severity incident response. This is a hands-on role where you'll operate independently while mentoring junior engineers and shaping how Ripple scales its security posture.

WHAT YOU'LL DO

• Design and tune detections within Google Security Operations to identify threats faster and more accurately across the environment.

• Lead incident response for complex, high-severity investigations—handling triage, root cause analysis, and remediation.

• Build security automation workflows using tools like Tines to eliminate manual work in detection, triage, and response cycles.

• Own SIEM and data pipeline quality, covering log source onboarding, parsing, normalization, and alert tuning.

• Use AI-assisted coding tools (Claude Code, OpenAI Codex) for detection engineering and automation, knowing when and how to apply them effectively.

• Work cross-functionally with IT and engineering teams to influence security initiatives and drive adoption of new tooling.

• Stay current on threat trends and translate them into concrete improvements to detection coverage and response playbooks.

• Mentor less experienced engineers and serve as a technical reference point for the team.

WHAT YOU'LL BRING

• 5+ years in security operations, detection engineering, or incident response with demonstrated ownership of end-to-end incident and detection work.

• Deep knowledge of security principles, tools, and practices specific to detection and response.

• Strong automation and scripting skills in Python or SOAR platforms, with experience connecting security tools via REST APIs.

• Hands-on SIEM and security data pipeline experience—you've done log onboarding and parsing, not just alert querying.

• Practical expertise extending and tuning EDR, identity, email security, and network tools rather than just operating them.

• Ability to write clear technical specs, identify risks early, and evaluate trade-offs thoughtfully.

• Strong problem-solving skills in ambiguous, high-pressure situations while remaining flexible and professional.

• Talent for understanding people's needs and coaching them toward success.

WHAT WE OFFER

• Annual base salary of 172,000–215,000 USD, plus equity and performance bonuses.

• Comprehensive benefits covering health, mental wellness, retirement, and family planning.

• Flexible in-office arrangement—10+ days monthly, decided with your manager and team.

• Professional development budget for continuous learning.

• Generous vacation, R&R days, wellness reimbursement, and industry-leading parental leave.

• Catered lunches, fully-stocked kitchens, team offsites, and regular company gatherings.