SRHG: Principal Detection & Response Engineer

Stone Ridge is a $39B diversified financial services firm that creates innovative capital markets solutions through a group of industry-leading operating companies. Founded in 2012 and based in New York, we build businesses and investment strategies in markets where deep expertise, proprietary data, and disciplined execution can create lasting advantages. 

We build products we want for ourselves and invest in all our strategies alongside our partners. Everything we do—from how we approach problems to how we work with one another—is grounded in our core values: Focus. Be Humble. Be Kind. 

Why Stone Ridge? 

Stone Ridge is intentionally flat, meritocratic, and demanding. Ideas matter more than titles, and people are trusted with meaningful responsibility. The bargain is simple: you get to work here, and in return, you commit to keep learning, keep improving, and striving to be the best in the industry at what you do. 

Stone Ridge Asset Management develops differentiated alternative investment strategies designed to provide valuable sources of return and diversification beyond traditional stocks and bonds. 

The Opportunity 

Stone Ridge is seeking a Principal Detection & Response Engineer to own how the firm detects and responds to security threats across its operating companies. You will be responsible for the end-to-end detection and response pipeline, from telemetry and threat intelligence through detection, AI-assisted triage, and incident response; for an intelligence-informed system that decides what to harden and detect first; and for the engineering standard of the team’s tooling. The role sits within Security, reports to the Chief Information Security Officer, and works closely with security engineering, platform and infrastructure teams, and governance, risk, and compliance. 

This is a distinctive opportunity to run detection and response for a multi-entity firm spanning asset management, reinsurance, digital asset custody, and power and compute infrastructure, with the mandate to engineer it properly rather than operate it by hand. It is a senior individual contributor role with broad technical ownership and no direct reports, suited to someone who is hands-on by choice, seeks out the highest-leverage work, and applies AI where it demonstrably improves detection and response. 

What You’ll Do 

• Own the end-to-end detection and response pipeline: telemetry collection, processing and enrichment, detection, AI-assisted triage, investigation, escalation, and response. Engineer it for reliability and maintainability, retire what does not earn its keep, and design so that others can operate what you build. 

• Build and maintain an intelligence-informed prioritization system that turns threat intelligence and the firm’s threat model into a ranked view of what to harden, what to detect, and what to automate first. 

• Engineer detections as code: versioned, tested, peer-reviewed detection logic and pipeline configuration, mapped to MITRE ATT&CK or an equivalent framework and measured for fidelity, latency, and cost. 

• Engineer, tune, and operate the SIEM, security data pipeline, endpoint detection, and automation and case-management platforms to maximize signal quality, coverage, and cost efficiency. 

• Set the standard for how alerts are triaged, investigated, and escalated; build the tooling and AI-assisted workflows that let the team meet it; and take a turn in the on-call rotation so the process stays grounded in reality. 

• Lead response to confirmed incidents end to end across corporate, cloud, production, and operational technology environments, and partner with governance, risk, and compliance on incident classification, regulatory notification, and audit-ready records. 

• Build detection and response coverage for the threats that matter most to the firm: identity and account takeover, phishing and business email compromise, insider risk and data exfiltration, cloud and SaaS misuse, and threats to digital asset custody and to power and data center infrastructure, designed to respect entity boundaries and differing regulatory regimes. 

• Evaluate and prove out new security technologies and AI capabilities with rigorous evaluation and guardrails, make clear build, buy, or retire recommendations, lead tabletop exercises, and keep playbooks current. 

What You Bring 

Required 

• Ten or more years in security operations, detection engineering, and incident response, including responsibility for building and maturing detection and response capability in complex, regulated environments 

• Strong engineering skills, including Python or Go, API-driven integrations, and infrastructure and detections as code (Terraform, Git-based review), producing code that other engineers can read, test, and maintain 

• Proven ability to design, operate, and measure an end-to-end detection and response pipeline on modern SIEM, security data pipeline, endpoint detection, and automation platforms 

• Experience detecting and responding in cloud and identity-centric environments, including AWS, an enterprise identity provider such as Okta, Microsoft 365 or Google Workspace, and SaaS audit logs 

• Track record of turning threat intelligence into prioritized hardening and high-fidelity detections, grounded in a strong understanding of attacker tactics and techniques 

• Demonstrated, current use of AI in your own security work, including LLM-assisted investigation and detection authoring, agentic tooling such as Claude Code and MCP integrations, and the judgment to know when the model is wrong; this is a minimum bar for every Stone Ridge technology and security hire and is assessed directly in the interview process 

• Ability to operate as a principal-level individual contributor: set technical direction without formal authority, choose high-leverage work over the merely urgent, and articulate the chain from threat to risk to control to executives 

Preferred 

• Direct experience with Splunk or CrowdStrike NG-SIEM, Cribl, CrowdStrike Falcon, and Tines or Splunk SOAR 

• Incident handling under financial services regulatory notification requirements, such as NYDFS Part 500 or SEC rules 

• Security experience in digital asset custody, data center, or operational technology environments 

• Experience mentoring engineers and raising the engineering bar of a security operations team 

What Success Looks Like 

• Owns triage, investigation, and response independently within the first quarter and is the person leaders call first when something looks wrong 

• Detection logic and pipeline configuration are version-controlled, tested, and peer-reviewed, and coverage against the firm’s threat model is measured and reviewed on a regular cadence 

• An intelligence-informed prioritization system is in place and visibly steering hardening and detection work across security and technology teams 

• Analyst time on repetitive triage falls measurably as AI-assisted and automated workflows take over routine cases, with evaluation evidence showing they are trusted for good reason 

• Incident response runs on rehearsed playbooks, and governance, risk, and compliance partners are confident that classification and regulatory notification are handled correctly