Security Engineer III - Security Operations

Role Overview

Accountabilities

• Plan and deliver end-to-end detection and response initiatives, from creating detection rules to implementing automated response workflows.
• Build, tune, and maintain security detections across Elastic SIEM and AWS environments, identifying and closing gaps in existing threat coverage.
• Manage the security investigation queue by triaging alerts, investigating suspicious activity, escalating incidents when necessary, and driving issues toward resolution.
• Document incident investigations and findings clearly to support follow-up actions, knowledge sharing, and operational consistency.
• Develop and maintain runbooks and automation workflows using Python and no-code tools such as Zapier or Tines to reduce manual work and accelerate incident response.
• Make and document risk decisions within your area of responsibility, escalating issues when additional expertise or support is required.
• Support compliance initiatives by maintaining audit-ready security controls and contributing evidence for frameworks such as SOC 2 and PCI DSS.
• Use Terraform and Python to build, maintain, and improve the infrastructure supporting security detections and operational tooling.
• Participate in the on-call rotation for security monitoring and incident response.
• Continuously improve detection coverage, investigation processes, and response efficiency.

Requirements

• Hands-on experience building, maintaining, and tuning SIEM detections; Elastic preferred, while Splunk, Microsoft Sentinel, or comparable platforms is also relevant.
• Practical experience securing AWS environments and implementing cloud-native detection and response capabilities.
• Proficiency in Python for scripting, automation, and security tooling.
• Experience with Terraform or other infrastructure-as-code technologies.
• Working knowledge of the MITRE ATT&CK framework and its application to threat detection and investigation.
• Demonstrated experience triaging, investigating, and resolving security incidents.
• Strong written communication skills, with the ability to document investigations, technical findings, and risk decisions in a clear, structured manner.
• Ability to work independently, prioritize security issues, and take ownership of assigned responsibilities.
• Willingness to participate in an on-call rotation for monitoring and incident response.

Nice To Have

• Experience with security orchestration, automation, and response (SOAR) platforms or no-code security automation tools.
• Familiarity with compliance frameworks such as PCI DSS, SOC 2, or ISO 27001.
• Experience in fintech, payments, or another regulated industry.

Benefits

• Fully remote working environment within a globally distributed team.
• Competitive share options.
• Flexible holiday policy, with a minimum of 25 days to be taken.
• Access to coworking spaces across major cities.
• Workations and an annual company retreat.
• High-quality equipment suited to your role.
• £500 contribution toward your home office setup.
• Generous learning budget to support continued professional growth.
• Private medical insurance.
• A range of other benefits depending on location.
• Structured onboarding and a collaborative environment that encourages learning and shared problem-solving.

Workplace

• Remote work: Fully remote working environment within a globally distributed team.

Application Notes

• This position is listed on behalf of a partner company, who manages all applications and next steps.
• Applications are reviewed via an AI-powered matching process against the role's core requirements; the shortlist is shared with the hiring company.