Security Engineer III - Security Operations

You will own key aspects of security detection and response, from developing detection rules and investigating incidents to automating workflows and maintaining audit-ready controls.

• Plan and deliver end-to-end detection and response initiatives, from creating detection rules to implementing automated response workflows.

• Build, tune, and maintain security detections across Elastic SIEM and AWS environments, identifying and closing gaps in existing threat coverage.

• Manage the security investigation queue by triaging alerts, investigating suspicious activity, escalating incidents when necessary, and driving issues toward resolution.

• Document incident investigations and findings clearly to support follow-up actions, knowledge sharing, and operational consistency.

• Develop and maintain runbooks and automation workflows using Python and no-code tools such as Zapier or Tines to reduce manual work and accelerate incident response.

• Make and document risk decisions within your area of responsibility, escalating issues when additional expertise or support is required.

• Support compliance initiatives by maintaining audit-ready security controls and contributing evidence for frameworks such as SOC 2 and PCI DSS.

• Use Terraform and Python to build, maintain, and improve the infrastructure supporting security detections and operational tooling.

• Participate in the on-call rotation for security monitoring and incident response.

• Continuously improve detection coverage, investigation processes, and response efficiency.

Requirements:

The ideal candidate has practical experience in security operations and cloud-native threat detection, with strong scripting skills and the ability to investigate incidents independently. You should be comfortable taking ownership of security outcomes while communicating findings and risks clearly.

• Hands-on experience building, maintaining, and tuning SIEM detections. Experience with Elastic is preferred, while Splunk, Microsoft Sentinel, or comparable platforms is also relevant.

• Practical experience securing AWS environments and implementing cloud-native detection and response capabilities.

• Proficiency in Python for scripting, automation, and security tooling.

• Experience with Terraform or other infrastructure-as-code technologies.

• Working knowledge of the MITRE ATT&CK framework and its application to threat detection and investigation.

• Demonstrated experience triaging, investigating, and resolving security incidents.

• Strong written communication skills, with the ability to document investigations, technical findings, and risk decisions in a clear, structured manner.

• Ability to work independently, prioritize security issues, and take ownership of assigned responsibilities.

• Willingness to participate in an on-call rotation for monitoring and incident response.

Nice to have:

• Experience with security orchestration, automation, and response (SOAR) platforms or no-code security automation tools.

• Familiarity with compliance frameworks such as PCI DSS, SOC 2, or ISO 27001.

• Experience in fintech, payments, or another regulated industry.

Benefits:

• Remote work: Fully remote working environment within a globally distributed team.

• Equity: Competitive share options.

• Paid time off: Flexible holiday policy, with a minimum of 25 days to be taken.

• Coworking access: Access to coworking spaces across major cities.

• Team events: Workations and an annual company retreat.

• Equipment: High-quality equipment suited to your role.

• Home office support: £500 contribution toward your home office setup.

• Learning and development: Generous learning budget to support continued professional growth.

• Healthcare: Private medical insurance.

• Additional perks: A range of other benefits depending on location.

• Professional support: Structured onboarding and a collaborative environment that encourages learning and shared problem-solving.