Payment Infrastructure Detection & Incident Response Engineer — Remote (United Kingdom; Ireland; South Africa)

Overview

Build and operate security monitoring across a distributed payments platform. Write and tune SIEM detections, investigate cloud and SaaS security incidents, automate triage and preserve audit-ready evidence while participating in an incident-response on-call rotation.

Requirements

• Hands-on security incident response from alert triage through investigation and documented resolution.
• Experience authoring and tuning SIEM detections with tools such as Elastic or Splunk and applying MITRE ATT&CK.
• Practical cloud-native detection and response in AWS or Google Cloud.
• Ability to write scripts or automation in Python or Go.
• Strong structured written communication during incidents and across security and engineering teams.
• Terraform/infrastructure as code, SOAR tools, PCI DSS/SOC 2/ISO 27001 and fintech security experience are useful but not mandatory.

Responsibilities

• Build, test and maintain actionable SIEM detections and onboard cloud, Kubernetes and SaaS logs.
• Identify monitoring gaps and reduce noisy or obsolete rules.
• Triage, investigate and resolve security incidents with clear records and escalation.
• Lead routine incident response and contribute to major investigations.
• Create incident runbooks and Python-based response automation.
• Participate in security incident on-call coverage.
• Maintain audit evidence and coordinate findings with application security teams.

Conditions

• Full-time fully remote role for candidates in the United Kingdom, Ireland or South Africa.
• Participation in an incident-response on-call rotation is required.

Tech stack

• Elastic SIEM
• Python
• AWS