Senior Security Engineer, Detection & Response

Accountabilities

• Security monitoring and detection engineering: Build, operate, and mature SIEM/XDR capabilities, including log ingestion pipelines, detection rules, alert tuning, monitoring, and investigation workflows. Improve detection accuracy while reducing false positives and unnecessary alert noise.

• Audit logging and attribution: Extend audit coverage across cloud infrastructure and applications, including Kubernetes audit logs, database activity, single sign-on (SSO), and access-path telemetry. Ensure sensitive-data access can be attributed to a specific person or workload and that logs are retained in line with compliance requirements.

• Incident response and root-cause analysis: Investigate and respond to security incidents across cloud environments and applications. Identify root causes, coordinate remediation, and ensure corrective measures prevent recurring issues.

• Threat hunting: Conduct proactive threat hunts across cloud and identity environments, analyzing telemetry and suspicious behavior to uncover potential threats before they escalate. Develop repeatable, AI-assisted hunting workflows to improve efficiency and coverage.

• Vulnerability management: Own the vulnerability-management lifecycle across infrastructure, platforms, and applications, including internal scanning, dependency analysis, assessment of external findings, validation of true positives, remediation coordination, and verification of fixes.

• External security findings: Triage and investigate external reports, including bug bounty submissions, distinguish actionable vulnerabilities from false positives, and coordinate timely resolution with the relevant engineering teams.

• Security architecture and threat modeling: Participate in threat modeling and security design reviews, evaluating new systems for detection, logging, monitoring, and incident-response requirements.

• Cloud and container security: Apply strong AWS, Linux, and Kubernetes security expertise to assess risks, strengthen configurations, and advise system owners on appropriate remediation measures.

• Compliance and audit readiness: Implement and support security controls aligned with PCI DSS, SOC 2, and other relevant compliance requirements. Maintain effective logging, monitoring, and audit evidence as part of day-to-day security operations.

• Automation and AI-assisted engineering: Develop automation and AI-powered workflows for alert triage, investigation, threat hunting, and security operations. Evaluate emerging tools pragmatically to improve productivity and expand the team's capabilities.

• On-call responsibilities: Participate in the detection and response on-call rotation and help maintain the reliability and effectiveness of the security services under your ownership.

• Cross-functional collaboration: Work closely with security, infrastructure, network, platform, and application engineering teams to validate controls, resolve security weaknesses, and embed security practices into the development lifecycle.

Requirements

• Professional experience: At least 6 years of experience in security, software, or infrastructure engineering, including hands-on responsibility for securing cloud-based production systems and addressing real-world security incidents.

• SIEM and detection engineering: Practical experience with SIEM platforms such as Wazuh, Splunk, or ELK, including detection-rule development, security monitoring, alert tuning, and incident investigation.

• Incident investigation: Ability to investigate suspicious activity directly using logs, cloud-native tools, system-level telemetry, and application or database data, translating technical findings into actionable security improvements.

• Vulnerability management: Strong hands-on experience with security scanning, vulnerability triage, validation of scanner and bug bounty findings, remediation coordination, and verification of completed fixes.

• Cloud infrastructure: Strong knowledge of AWS, Linux, and Kubernetes, including cloud security architecture, identity and access management, network segmentation, container security, and operational best practices.

• Security fundamentals: Solid understanding of common security vulnerabilities, attack techniques, and mitigation strategies, informed by established guidance such as OWASP and SANS.

• Security architecture: Experience evaluating the security implications of new systems and contributing to design reviews, threat modeling, and logging or monitoring strategy.

• Compliance knowledge: Working knowledge of security and compliance frameworks such as PCI DSS and SOC 2, particularly their requirements for logging, monitoring, evidence collection, and audit readiness.

• AI-forward engineering: Demonstrated practical use of AI-assisted engineering tools, such as Claude Code, Codex, Cursor, or custom large language model integrations, with a clear understanding of their strengths, limitations, and appropriate applications.

• Preferred technical experience: Familiarity with telemetry pipelines, log-based detection, security analytics, internal penetration testing, adversarial exercises, and translating attack findings into improved detections and remediation plans.

• Security tooling: Experience operating container and dependency security tools such as Snyk, Trivy, or Grype and managing the vulnerabilities they identify.

• Industry exposure: Experience in fintech, payments, or another regulated industry is an advantage, particularly where security controls must support demanding operational and regulatory requirements.

• Education: A bachelor's degree in Computer Science, Computer Engineering, or a relevant technical field is expected.

• Analytical mindset: Strong investigative and problem-solving skills, with the ability to turn complex technical telemetry into clear findings, effective detections, and lasting solutions.

• Ownership and accountability: A proactive, hands-on approach, with a commitment to assigning clear ownership to findings, following issues through to resolution, and maintaining high standards of technical quality.

• Communication and collaboration: Ability to challenge assumptions constructively, communicate risks clearly, work effectively across teams, and balance security requirements with practical business needs.

• Adaptability and execution: Comfort working in a fast-moving environment, making informed decisions, embracing new approaches, and delivering measurable outcomes without unnecessary delays.

Benefits

• Competitive compensation: Gross monthly salary ranging from $5,000 to $9,500 USD, depending on experience, expertise, and the level of contribution expected.

• Remote work: A remote opportunity with a full-time employment arrangement, offering flexibility in where you work, subject to the role's location and employment requirements.

• High-impact security work: The opportunity to strengthen detection and response capabilities across cloud infrastructure, applications, and sensitive data in a technology-driven environment.

• AI-assisted engineering: Opportunities to use and develop AI-powered workflows that improve security investigations, threat hunting, alert triage, and operational efficiency.

• Technical ownership: End-to-end responsibility for meaningful security initiatives, from identifying vulnerabilities and investigating incidents to implementing lasting fixes.

• Modern technology stack: Exposure to AWS, Kubernetes, Linux, Go, TypeScript, Python, MySQL, PostgreSQL, Elasticsearch, GitLab, and automated testing practices.

• Engineering-focused culture: An emphasis on practical problem-solving, open-source technologies, experimentation, continuous improvement, and building solutions where appropriate.

• Collaborative environment: The opportunity to work alongside experienced professionals across security, infrastructure, networking, and software engineering.

• Professional development: Opportunities to deepen expertise in cloud security, detection engineering, incident response, vulnerability management, and emerging AI technologies.

• Meaningful responsibility: A chance to influence security standards, improve operational resilience, and help protect critical systems in a fast-paced business environment.