Senior Security Incident Response Engineer

About Rippling

Rippling gives businesses one place to run HR, IT, and Finance. It brings together all of the workforce systems that are normally scattered across a company, like payroll, expenses, benefits, and computers. For the first time ever, you can manage and automate every part of the employee lifecycle in a single system.

Take onboarding, for example. With Rippling, you can hire a new employee anywhere in the world and set up their payroll, corporate card, computer, benefits, and even third-party apps like Slack and Microsoft 365—all within 90 seconds.

Based in San Francisco, CA, Rippling has raised $1.4B+ from the world’s top investors—including Kleiner Perkins, Founders Fund, Sequoia, Greenoaks, and Bedrock—and was named one of America's best startup employers by Forbes.

We prioritize candidate safety. Please be aware that all official communication will only be sent from @Rippling.com addresses.

About The Role

We are looking for a Senior Security Incident Response Engineer to join our Detection and Response Team (DART). In this role, you will be at the forefront of handling security incidents, working to investigate, contain, and mitigate threats across Rippling’s environments. You will play a pivotal role in developing and optimizing our incident response function, ensuring that security incidents are managed efficiently and effectively, while continuously improving our processes and infrastructure.

You will work alongside cross-functional teams to respond to complex security incidents, drive improvements in detection and response capabilities, and create scalable solutions to manage and address emerging threats. This is an opportunity to build out Rippling's incident response function from the ground up, providing leadership and technical expertise to secure our production and corporate environments

What You Will Do

• Lead and coordinate the response to security incidents, including triage, investigation, analysis, and communication to internal and external stakeholders.
• Develop and maintain incident response playbooks and runbooks for new and existing threat scenarios.
• Automate and optimize workflows for detection, incident analysis, and response, improving the speed and effectiveness of incident handling.
• Improve security detection capabilities through rule development, tuning, and proactive threat hunting to identify potential attack vectors.
• Conduct root cause analysis of incidents and suggest improvements to processes and technologies to prevent future occurrences.
• Collaborate with teams across Rippling to implement security measures and mitigation strategies that enhance detection and response capabilities.
• Provide expert input on the design and implementation of security controls, processes, and automation tools.

What You Will Need

• Strong communication …