‹ All jobs
Security Engineer III - Detection & Response
<p style="min-height:1.5em"><strong>An Introduction to Primer</strong></p><p style="min-height:1.5em">Primer is the unified infrastructure for global payments. We give finance and payments teams the visibility and control to reduce complexity, improve performance, and capture more revenue - all from a single platform.<br /><br />Backed by Sofina, Peak XV Partners, ICONIQ, Tencent, Accel, and Balderton, we're building the payments layer the world's best companies rely on.</p><p style="min-height:1.5em"></p><p style="min-height:1.5em"><a target="_blank" rel="noopener noreferrer nofollow" href="https://primer.io/the-primer-showcase">Watch our showcase ></a></p><p style="min-height:1.5em"><a target="_blank" rel="noopener noreferrer nofollow" href="https://www.primer.io/blog/series-c">Read up on our $100m Series C</a></p><p style="min-height:1.5em"><a target="_blank" rel="noopener noreferrer nofollow" href="https://primer.io/careers">Learn more about our culture ></a></p><p style="min-height:1.5em"></p><p style="min-height:1.5em">Primer processes payments for some of the world's best companies, which makes us an attractive target and means getting detection and response right really matters. We're looking for a Security Engineer to join our Detection & Response function and own a meaningful slice of how we detect, investigate and respond to threats across our cloud infrastructure and SaaS estate.</p><p style="min-height:1.5em"></p><p style="min-height:1.5em">You'll write and tune the detections in our SIEM, build the automation that speeds up how we react, and be a first responder when something looks wrong. You'll have real ownership of the areas you work on, and the freedom to shape how we detect and respond to threats across them.</p><p style="min-height:1.5em"></p><p style="min-height:1.5em">You'll also work closely with our Application Security/Product Security engineers: what we learn from detections and incidents shapes how we build, and what they know about our products shapes what we look for.</p><p style="min-height:1.5em"><br /><strong>What you'll be doing</strong></p><p style="min-height:1.5em"><strong>Detection</strong></p><ul style="min-height:1.5em"><li><p style="min-height:1.5em">Build, tune and maintain detections in our SIEM (Elastic), and identify opportunities to onboard new log sources (e.g. AWS, Google Workspace, Kubernetes) and build new detections on top of them.</p></li><li><p style="min-height:1.5em">Find what our current detections miss, and keep the rule set lean by removing what no longer adds value.</p></li><li><p style="min-height:1.5em">Use Python and Terraform to build and maintain the infrastructure behind your detections and tooling.</p></li></ul><p style="min-height:1.5em"><strong>Response</strong></p><ul style="min-height:1.5em"><li><p style="min-height:1.5em">Own investigation: triage, investigate, escalate and resolve security incidents, and write up findings clearly enough to stand on their own</p></li><li><p style="min-height:1.5em">Lead routine incidents end to end, and take a clear role in larger ones, whether that's driving the investigation or keeping stakeholders informed</p></li><li><p style="min-height:1.5em">Build runbooks a