← All roles

Staff Security Engineer - Detection and Response

Ridgeline· Security Engineering
Apply on company site
Hybrid (San Ramon, CA), Hybrid (Reno, NV)$205k - $256kFull-timePosted 2mo ago

About the role

Staff-level security engineering role focused on detection and response within Ridgeline’s Detections and Response Team (DART). Architect AI-augmented detection/response pipelines, lead incident response for high-impact events, and set technical direction for DART codebases and infrastructure while ensuring responsible AI usage.

Responsibilities

  • Shape the DART roadmap based on business priorities and threat models, proactively identifying detection requirements during the design phase of new features and infrastructure.
  • Eliminate detection gaps by performing variant analysis to close entire classes of vulnerabilities rather than addressing individual findings.
  • Architect AI-powered detection and triage pipelines that maintain accuracy and reduce manual effort, minimizing false positives so every alert warrants a response.
  • Collaborate as a key architect for our SIEM, SOAR, and adjacent security platforms, designing scalable, resilient ingestion, enrichment, and alerting frameworks.
  • Own the technical architecture and maturity of our incident response program, guiding the response to complex high-impact events, interfacing with leadership during major incidents, and driving findings to systemic remediation.
  • Set the technical direction for DART-owned codebases and infrastructure, making sound architectural tradeoffs that balance speed, correctness, and maintainability.
  • Establish team standards for the effective and responsible use of AI in detection and response workflows, including appropriate human-in-the-loop guardrails.
  • Influence security strategy across engineering organizations, building consensus with Staff+ engineers through technical credibility instead of unilateral directives.
  • Elevate the team's technical expertise by mentoring junior and mid-level engineers through code reviews, collaborative problem solving, and knowledge sharing.

Qualifications

  • 8+ years working in detection, security operations, incident response, or software engineering, with a proven track record of leading cross-functional technical initiatives.
  • Advanced proficiency in Python (preferred) or another high-level language like Kotlin or TypeScript.
  • Demonstrated skill engineering AI/LLM-driven systems: capable of building augmented detection, triage, and investigation workflows and rigorously validating their output for correctness and risk.
  • Expertise authoring detections mapped to attacker TTPs (e.g., MITRE ATT&CK).
  • Extensive background building and operating detection-as-code and alerting pipelines, tuned for signal quality and noise reduction.
  • Strong command of the AWS ecosystem, specifically across logging and telemetry (CloudTrail, VPC Flow Logs, GuardDuty, CloudWatch), investigative tools (Athena, IAM analysis), and compute (Lambda, ECS/EKS).
  • Fluency with infrastructure-as-code (e.g., Terraform) and CI/CD practices.
  • Strong written and verbal communication skills, with the ability to explain detection and response decisions clearly to engineers, product partners, and stakeholders.

Skills

Required:PythonAI/LLM-driven detectionMITRE ATT&CK mappingAWS ecosystemInfrastructure as codeCI/CD practices

Benefits

  • unlimited vacation
  • educational and wellness reimbursements
  • $0 cost employee insurance plans
Last updated Aug 19, 2026. Interested? Apply on the company site.

About Ridgeline

Revolutionizing Investment Management

Ridgeline: Revolutionizing Investment Management with a single front-to-back system of record, embedded AI, and automation capabilities.

Investment ManagementAIAutomationPortfolio ManagementTradingComplianceData
Company profileWebsite

More open roles at Ridgeline