Senior Security Engineer, Detection and Response

THE WORK:

Through our blockchain technology and rapidly growing network of financial institutions, Ripple is improving the global financial system and increasing economic inclusion for more people, in more places around the world.  Ripple is looking for passionate Information Security professionals to build a world class Information Security program.  As part of the Information Security team, you will help us achieve this mission by actively working to protect our staff, company, and the larger crypto communities we engage with.  

Ripple's Detection & Response team defends against internal and external threats across our company and services. We are focused on protecting Ripple, our revolutionary payment technology, our employees, and our customers. To accomplish this, we are building data pipelines and detections, automating incident response, and developing leading-edge solutions to collect and analyze data in both security incidents and investigations.  As a Detection and Response Engineer, you will build and grow your career in all of these areas.

WHAT YOU’LL DO:

• Help lead the overall detection and response strategy
• Continually improve our ability to monitor for anomalies and detect malicious activity
• Analyze applications and systems to identify relevant data sources for threat detections
• Tune and test detection logic to reduce false positives and noise
• Work with technology vendors to optimize security services for peak effectiveness
• Research and collaborate internally and externally on open-source solutions
• Automate response processes with SOAR and related technologies
• Act in a purple team capacity to ensure effectiveness of security systems and controls
• Participate in cross-functional security functions to help drive continual program improvements

WHAT YOU'LL BRING: 

• 5+ years of experience working within a security operations environment
• At least  year of experience in writing detections, SIEM rules, or EDR 
• Significant experience with standard  incident response processes
• Expertise in a broad range of information technologies, such as public cloud infrastructure (AWS,GCP), authentication systems, vulnerability management solutions, network infrastructure, etc.
• Someone that has contributed to the development of detection and alerting pipelines
• Experience in dissecting attacker methodologies and techniques
• Comprehensive understanding of product and infrastructure logs from a security perspective
• Experience building and delivering projects from start to finish
• Knowledge of a broad range of attacker tactics, techniques, and procedures (TTP’s)
• Above all, a team player that can handle challenging situations, a rapidly maturing security culture, and an eagerness to mentor less experienced engineers