Security Engineer III - Security Operations

Accountabilities:: You will own key aspects of security detection and response, from developing detection rules and investigating incidents to automating workflows and maintaining audit-ready controls. Plan and deliver end-to-end detection and response initiatives, from creating detection rules to implementing automated response workflows. Build, tune, and maintain security detections across Elastic SIEM and AWS environments, identifying and closing gaps in existing threat coverage. Manage the security investigation queue by triaging alerts, investigating suspicious activity, escalating incidents when necessary, and driving issues toward resolution. Document incident investigations and findings clearly to support follow-up actions, knowledge sharing, and operational consistency. Develop and maintain runbooks and automation workflows using Python and no-code tools such as Zapier or Tines to reduce manual work and accelerate incident response. Make and document risk decisions within your area of responsibility, escalating issues when additional expertise or support is required. Support compliance initiatives by maintaining audit-ready security controls and contributing evidence for frameworks such as SOC 2 and PCI DSS. Use Terraform and Python to build, maintain, and improve the infrastructure supporting security detections and operational tooling. Participate in the on-call rotation for security monitoring and incident response. Continuously improve detection coverage, investigation processes, and response efficiency. Requirements: The ideal candidate has practical experience in security operations and cloud-native threat detection, with strong scripting skills and the ability to investigate incidents independently. You should be comfortable taking ownership of security outcomes while communicating findings and risks clearly. Hands-on experience building, maintaining, and tuning SIEM detections. Experience with Elastic is preferred, while Splunk, Microsoft Sentinel, or comparable platforms is also relevant. Practical experience securing AWS environments and implementing cloud-native detection and response capabilities. Proficiency in Python for scripting, automation, and security tooling. Experience with Terraform or other infrastructure-as-code technologies. Working knowledge of the MITRE ATT&CK framework and its application to threat detection and investigation. Demonstrated experience triaging, investigating, and resolving security incidents. Strong written communication skills, with the ability to document investigations, technical findings, and risk decisions in a clear, structured manner. Ability to work independently, prioritize security issues, and take ownership of assigned responsibilities. Willingness to participate in an on-call rotation for monitoring and incident response. Nice to have: Experience with security orchestration, automation, and response (SOAR) platforms or no-code security automation tools. Familiarity with compliance frameworks such as PCI DSS, SOC 2, or ISO 27001. Experience in fintech, payments, or another regulated industry. Benefits: Remote work: Fully remote working environment within a globally distributed team. Equity: Competitive share options. Paid time off: Flexible holiday policy, with a minimum of 25 days to be taken. Coworking access: Access to coworking spaces across major cities. Team events: Workations and an annual company retreat. Equipment: High-quality equipment suited to your role. Home office support: £500 contribution toward your home office setup. Learning and development: Generous learning budget to support continued professional growth. Healthcare: Private medical insurance. Additional perks: A range of other benefits depending on location. Professional support: Structured onboarding and a collaborative environment that encourages learning and shared problem-solving.