Security Engineer, Detection & Response

<div class="content-intro"><h2>Join us in building the future of finance.</h2> <p>Our mission is to democratize finance for all. <a href="https://www.cerulli.com/press-releases/cerulli-anticipates-124-trillion-in-wealth-will-transfer-through-2048" target="_blank">An estimated $124 trillion of assets</a> will be inherited by younger generations in the next two decades. The largest transfer of wealth in human history. If you’re ready to be at the epicenter of this historic cultural and financial shift, keep reading.</p></div><h2><strong>About the team + role</strong></h2> <p>We are building an elite team, applying frontier technologies to the world’s biggest financial problems.<strong> </strong>We’re looking for bold thinkers. Sharp problem-solvers. Builders who are wired to make an impact. Robinhood isn’t a place for complacency, it’s where ambitious people do the best work of their careers. We’re a high-performing, fast-moving team with ethics at the center of everything we do. Expectations are high, and so are the rewards.&nbsp;</p> <p>The Security Operations (SecOps) team works to safeguard Robinhood and its customers by identifying, investigating, and responding to security threats. The team monitors production systems, endpoints, and cloud environments, and uses threat intelligence and structured testing to uncover risks before they affect customers. SecOps partners closely with engineering and infrastructure teams to strengthen detection coverage and response readiness. The team’s focus is clear: reduce risk, improve visibility, and protect customer trust every day!</p> <p>As a Security Engineer, Detection &amp; Response, you will strengthen Robinhood’s ability to detect, investigate, and contain security incidents. You will design and improve detection logic, analyze security telemetry across cloud and endpoint systems, and contribute to measurable reductions in false positives and detection gaps. You will work directly with SOC analysts and security engineers to refine investigation workflows and document incident findings. This role is ideal for someone who enjoys hands-on detection engineering and improving how teams respond to real-world threats!</p> <p><strong>This role is based in our Ljubljana office, with in-person attendance expected at least 3 days per week.</strong></p> <p>At Robinhood, we believe in the power of in-person work to accelerate progress, spark innovation, and strengthen community. Our office experience is intentional, energizing, and designed to fully support high-performing teams.&nbsp;</p> <p>Applications for this role will be accepted through June 30, 2026</p> <p>Requires participation in an on-call rotation to support business needs.</p> <h2><strong>What you’ll do</strong></h2> <ul> <li>Investigate security alerts across SIEM, EDR, and cloud security platforms, perform log analysis, and coordinate containment or remediation steps with engineering partners</li> <li>Develop, test, and tune detection rules using query languages to improve signal quality and reduce false positives</li> <li>Correlate data from multiple telemetry sources to identify attack patterns and determine appropriate response actions</li> <li>Monitor emerging threats and update detection logic based on investigation findings and threat intelligence reporting</li> <li>Contribute to automation efforts by building or refining SOAR playbooks and scripts that improve investigation speed and consistency</li> <li>Document incidents and contribute to post-incident reviews with clear findings and recommended improvements to detection and response processes</li> </ul> <h2><strong>What you bring</strong></h2> <ul> <li>2–4 years of experience in security operations, detection engineering, or incident response</li> <li>Experience analyzing logs and tuning alerts within SIEMs, EDR platforms, and cloud security tools</li> <li>Experience writing detections using query languages (e.g., SQL-like, KQL, or similar)</li> <li>Familiarity with threat hunting and investigation techniques across cloud and endpoint environments</li> <li>Ability to analyze security telemetry, identify patterns of malicious activity, and recommend practical improvements</li> <li>Clear written and verbal communication skills when documenting incidents and collaborating with technical teams</li> <li>English proficiency is required&nbsp;</li> </ul> <h2><strong>What we offer</strong></h2> <ul> <li>Challenging, high-impact work to grow your career</li> <li>Performance driven compensation with multipliers for outsized impact and bonus programs</li> <li>Top tier benefits to fuel your work, including supplemental health insurance, ancillary insurance, and mental health support programs</li> <li>Lifestyle wallet - a highly flexible employer-paid benefits spending account expenses beyond traditional benefits such as wellness, childcare, learning, and more.</li> <li>Time off to recharge including company holidays, paid time off, sick time, paid volunteer time off, parental leave, and more!</li> <li>Exceptional office experience with catered meals, events, and comfortable workspaces.&nbsp;</li> <li>Monthly commuter stipend to help offset in-office commuting costs</li> </ul><div class="content-conclusion"><p>Click <a href="https://careers.robinhood.com/benefits" target="_blank">here</a> to learn more about our Total Rewards, which vary by region and entity.</p> <p>If our mission energizes you and you’re ready to build the future of finance, we look forward to seeing your application.</p> <p>Robinhood provides equal opportunity for all applicants, offers reasonable accommodations upon request, and complies with applicable equal employment and privacy laws. Inclusion is built into how we hire and work—welcoming different backgrounds, perspectives, and experiences so everyone can do their best. Please review the&nbsp;<a href="https://careers.robinhood.com/applicantprivacypolicy" target="_blank">Privacy Policy</a> for your country of application.</p></div>