Security Engineer III - Security Operations

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security Engineer III - Security Operations based in the United States.

Join a globally distributed engineering team focused on protecting critical cloud infrastructure and strengthening security operations within a modern payments environment. As a Security Engineer III, you will take ownership of key detection and response capabilities, helping identify emerging threats, investigate incidents, and improve security coverage. You will build and optimize SIEM detections, automate response workflows, and develop reliable security tooling using Python and infrastructure-as-code practices. Working across cloud infrastructure, compliance, and incident response, you will help reduce operational risk while making security processes more efficient. Build, tune, and maintain security detections across Elastic SIEM and AWS environments, identifying and closing gaps in existing threat coverage.
Document incident investigations and findings clearly to support follow-up actions, knowledge sharing, and operational consistency.
Develop and maintain runbooks and automation workflows using Python and no-code tools such as Zapier or Tines to reduce manual work and accelerate incident response.
Make and document risk decisions within your area of responsibility, escalating issues when additional expertise or support is required.
Use Terraform and Python to build, maintain, and improve the infrastructure supporting security detections and operational tooling.
Participate in the on-call rotation for security monitoring and incident response.
The ideal candidate has practical experience in security operations and cloud-native threat detection, with strong scripting skills and the ability to investigate incidents independently. You should be comfortable taking ownership of security outcomes while communicating findings and risks clearly.

Hands-on experience building, maintaining, and tuning SIEM detections. Experience with Elastic is preferred, while Splunk, Microsoft Sentinel, or comparable platforms is also relevant.
Practical experience securing AWS environments and implementing cloud-native detection and response capabilities.
Proficiency in Python for scripting, automation, and security tooling.
Working knowledge of the MITRE ATT&CK framework and its application to threat detection and investigation.
Strong written communication skills, with the ability to document investigations, technical findings, and risk decisions in a clear, structured manner.
Willingness to participate in an on-call rotation for monitoring and incident response.
Experience with security orchestration, automation, and response (SOAR) platforms or no-code security automation tools.
Remote work:

Fully remote working environment within a globally distributed team.
Equity:

Competitive share options.
Flexible holiday policy, with a minimum of 25 days to be taken.
Equipment:

High-quality equipment suited to your role.
Home office support:

£500 contribution toward your home office setup.
Generous learning budget to support continued professional growth.
Healthcare:

Private medical insurance.
Structured onboarding and a collaborative environment that encourages learning and shared problem-solving.
\We use an

AI-powered matching process

to ensure your application is reviewed quickly, objectively, and fairly against the roles core requirements. Data Privacy Notice:

By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR).