Staff Security Engineer, Detection & Response

Join us in building the future of finance. Our mission is to democratize finance for all. An estimated $124 trillion of assets will be inherited by younger generations in the next two decades.

The largest transfer of wealth in human history. If you’re ready to be at the epicenter of this historic cultural and financial shift, keep reading.

About The Team

+ role We are building an elite team, applying frontier technologies to the world’s biggest financial problems. We’re looking for bold thinkers. Sharp problem-solvers.

Builders who are wired to make an impact. Robinhood isn’t a place for complacency, it’s where ambitious people do the best work of their careers. We’re a high-performing, fast-moving team with ethics at the center of everything we do.

Expectations are high, and so are the rewards.

The Security Operations (SecOps) team at Robinhood proactively safeguards our platform and millions of customers. We monitor, detect, and respond to security threats in real time while staying ahead of risks through threat intelligence, Red Team operations, and research partnerships. We are building the next generation of security operations—leveraging AI-driven automation, Autonomic Security Operations (ASO), and innovative detection frameworks to set the standard across the cybersecurity industry!

About The Role

As a Staff Security Engineer (IC6) on the Detection & Response team, you will drive our incident response strategy, build robust detection engineering frameworks, and mentor engineers across the organization. In this high-impact role, you will command high-stress incident responses, eliminate operational noise by developing an AI-native detection platform, and help shape the broader AI-agentic ecosystem for SecOps. You will work closely with cross-functional partners in Proactive Security, Security Engineering, Insider Trust, Infrastructure, Legal, and Communications to protect Robinhood’s ecosystem.

This role is based in our Bellevue, WA and Menlo Park, CA office(s), with in-person attendance expected at least 3 days per week. At Robinhood, we believe in the power of in-person work to accelerate progress, spark innovation, and strengthen community. Our office experience is intentional, energizing, and designed to fully support high-performing teams.

What You’Ll Do

Lead Incident Response: Command security incident response workstreams with decisive leadership, rapidly containing threats, quantifying impact, and communicating effectively with leadership. Elevate Detection Rigor: Build, tune, and maintain our global detection catalog across our cloud and kubernetes environments to ensure high precision and actionable alerting. Drive Strategic Innovation: Architect our Autonomic Security Operations (ASO) roadmap, integrating AI agents and automated issue discovery to transform response capabilities.

Code & Architecture Analysis: Read and reason through complex, multi-language codebases to identify security vulnerabilities, evaluate threat vectors, and guide remediation. Mentor & Elevate the Team: Foster a culture of technical excellence, trust, and continuous learning by mentoring engineers and bringing charisma to team development. On-Call Support: Participate in an on-call rotation (1 week per rotation) to maintain real-time operational readiness.

What you bring 8+ years of experience in Detection & Response, Incident Response, or Security Operations. Proven Command Presence: Demonstrated success leading complex incident responses under pressure with clear, action-oriented executive communication. Deep Cloud & Infrastructure Expertise: Advanced technical experience securing cloud environments with a focus on Kubernetes.

Code Reasoning Skills: Ability to fluently read, analyze, and reason through code across multiple programming languages to solve complex security challenges.