Security Operations Engineer

As a Security Operations Engineer at Yellow Card Financial, you are the operational backbone of the Security Operations Centre (SOC). You own three integrated domains: security alert design, triage, and automated response; cloud security posture management across EKS and AWS environments; and posture tracking and reporting. Reporting to the Associate Director, Product & Infrastructure Security, you work alongside a mature Application Security team and collaborate closely with DevOps, Engineering, and Security GRC functions, progressively driving down manual effort through detection-as-code and SOAR automation.

What you'll do

• Design and maintain SIEM detection rules covering cloud, container, identity, and application layers, using both signature-based and behavioural logic
• Map detection coverage against the MITRE ATT&CK framework and identify gaps relevant to the organisation's AWS and EKS attack surface
• Integrate threat intelligence feeds to refresh rule logic for emerging threats and TTPs
• Maintain a detection backlog, prioritised by risk, with defined review cadences
• Perform daily SIEM alert triage following defined response timing standards
• Classify, investigate, and resolve security signals
• Reduce false-positive rates through structured tuning cycles, with documented rationale for rule changes
• Maintain triage runbooks for key production detection rules
• Build and maintain SOAR playbooks for common alert types including IAM anomalies, misconfiguration alerts, exposed secrets, and container runtime events
• Automate enrichment steps such as asset lookup, threat intel correlation, and ownership resolution to reduce analyst time-to-context
• Document automation logic and maintain version control for all playbooks
• Measure and report automation coverage rate as a standing KRI
• Own the end-to-end vulnerability triage process for cloud and container environments, prioritising findings by business impact using CVSS scoring, asset criticality, and exploitability context
• Manage EKS-specific vulnerability coverage: base image currency, workload scanning results, pod security standards compliance, and node group patching cadence
• Coordinate remediation with engineering teams by opening well-scoped tickets, tracking progress, and escalating SLA breaches
• Maintain MTTR and SLA compliance data by severity tier
• Oversee CSPM posture score targets and triage new Critical findings within defined SLA windows
• Review and approve IAM policy changes, enforcing least-privilege and flagging over-permissioned roles or service accounts
• Execute scheduled IAM hygiene reviews: unused credentials, stale access keys, overly broad policies, and cross-account trust boundaries
• Govern workload identity configurations in EKS, ensuring service accounts carry only the permissions required
• Support the secrets rotation program and enforce zero hardcoded credentials across the estate
• Review and approve cloud network security changes: security group modifications, network ACL changes, and routing updates
• Own container image security: base image update cadence, scanning results review, and image ownership classification
• Investigate and remediate misconfiguration alerts surfaced by CSPM tooling within defined SLA windows
• Maintain a configuration baseline for critical cloud resources and flag drift
• Collect and maintain Key Risk Indicator data across SOC and cloud domains on defined cadences
• Execute infrastructure security control checks on weekly, monthly, and quarterly cadences
• Produce structured findings reports for each review cycle, flagging control failures for escalation
• Provide SOC and cloud posture metrics, including trends, at the required reporting cycles
• Support external audit and due diligence processes by providing evidence artefacts
• Co-own the shared vulnerability backlog with the Application Security team, ensuring consistent prioritisation methodology across domains
• Serve as the infrastructure and identity SME for the AppSec team during application security assessments and architecture reviews
• Own infrastructure containment during incidents that span application and infrastructure layers, working alongside AppSec for root cause analysis
• Provide infrastructure, identity, and network security review for new third-party integrations prior to deployment
• Collaborate with the Security GRC function on control evidence and compliance mapping, particularly for SOC 2, ISO 27001, and GDPR requirements

What you bring

• Fluency in English, both written and verbal
• Ability to collaborate with cross-functional teams and across different time zones
• 3 to 5 years of experience in security operations, cloud security, or infrastructure security engineering
• Hands-on AWS security experience: IAM policy design, virtual network architecture, cloud-native security services, CloudTrail, GuardDuty
• Kubernetes and EKS security experience: pod security standards, network policy enforcement, workload identity, image scanning
• SIEM operations: alert triage, detection rule authoring (signature-based and behavioural), log analysis and correlation
• Vulnerability management: CSPM tooling, risk-based prioritisation, CVSS scoring, SLA framework operation
• IaC security: ability to read and review Terraform or CloudFormation for misconfigurations
• Incident response: investigation, containment, and post-incident reporting
• Experience in a regulated environment (FinTech, payments, banking, or crypto preferred)
• Ability to author and tune detection rules without relying on vendor-supplied defaults
• Structured written communication for triage reports, post-incident write-ups, and stakeholder metrics
• Ability to coordinate remediation across engineering teams without direct authority
• Comfort operating in a lean team where domain boundaries are broader than in large enterprise security functions

Nice to have

• Professional certifications: AWS Security Specialty
• Experience with CSPM and SIEM platforms: Datadog, Wiz, Orca Security
• Experience with secrets management platforms: AWS Secrets Manager
• Familiarity with compliance frameworks: SOC 2, ISO 27001, GDPR, DORA
• Scripting ability in Python or Bash for detection-as-code and operational automation
• Experience with SOAR or workflow automation platforms
• Understanding of cryptocurrency or blockchain security considerations
• Experience in a startup or scale-up environment
• AI tooling familiarity and interest in applying AI to operational workflows

What we offer

• Competitive compensation and meaningful health coverage
• Stock option plan participation for all full-time employees
• Access to resources, support, and autonomy to grow professionally
• Fully remote work environment
• Mental health support services
• Ownership of the SOC and cloud security posture function from day one in a high-growth FinTech environment
• Broad domain exposure: detection engineering, cloud security, container security, incident response, and compliance
• Collaborative team culture with a mature AppSec function and strong leadership support

About Yellow Card Financial

Yellow Card is the largest licensed Stablecoin-based infrastructure provider operating across over 60 countries. The company provides Stablecoin payment infrastructure, fiat settlement rails, wallet services, and custom local Stablecoin issuance across 50 emerging markets. Yellow Card operates with a global team spanning 24 countries, speaking over 25 languages collectively.