Security Operations Engineer - Remote-First

EPI Company; France; À distance; EUR 90 000 - 120 000; Plein temps

Avantages offerts par ce poste

Remote-first culture

EU work mobility

Bonus potential

Learning budget €5,000

Résumé du poste

European Payments Initiative (EPI) seeks an experienced Operations Security Engineer to join its Security Operations capability. You will triage alerts, respond to incidents, and hunt threats across cloud, identity, endpoint and applications in a remote-first, pan-European setup.

You will work with SOC, IAM, security and DevOps teams to sharpen detections, improve tooling, and maintain clear communication across technical and non‑technical stakeholders.

Qualifications

• 8+ years in cybersecurity with hands-on SOC roles.
• Fluent in English; other European languages a plus.
• Experience across the full SOC lifecycle from alert triage to response.
• Proficient with SIEM/EDR, log parsing and detection engineering.

Responsabilités

• Triaging alerts, identifying incidents, and investigating security events.
• Lead incident response using structured frameworks (e.g., SANS PICERL).
• Threat hunting based on attacker behavior, threats, and MITRE ATT&CK.
• Design and tune detection rules, playbooks, and automation workflows.
• Communicate findings clearly to technical and non-technical stakeholders.
• Collaborate with engineering, SOC, IR and IT to improve resilience.
• Participate in 24/7 on-call rotation approximately one week per month.

Connaissances

SOC analyst

Incident response

Threat hunting

Detection engineering

SIEM/EDR

Log analysis

Scripting (Python/PowerShell/KQL)

Cloud telemetry

On-call readiness

Communication

Formation

Bachelor's degree in cybersecurity or related field

Outils

Rapid7

Microsoft Defender

SIEM

EDR

AWS

Azure

Microsoft Entra ID

Okta

PagerDuty

Python

PowerShell

KQL

Jira

Confluence

GitHub

Description du poste

Be part of a movement to change the way Europe pays

In today’s digital Europe, payments still feel too complicated. Random delays, confusing rules, extra apps and accounts make it harder than it should be to pay and get paid.

The European Payments Initiative is changing that with Wero, a proudly European digital wallet to make payments easier, clearer and more secure. Online, in store, at home and across borders, with your money and data protected under European laws and regulations.

Wero is live in Belgium, France, Germany and the Netherlands and launching very soon in Luxembourg and Austria. Backed by 17 major banks and the two largest European acquirers, we’re building a brand new, proudly European payment system. Why not join us?

What's in it for you

Play a key role in protecting Europe’s next-generation payment infrastructure. As an Operations Security Engineer, you will be at the heart of EPI's Security Operations capability: triaging alerts, responding to incidents, improving detection coverage and proactively hunting for threats across cloud, identity, endpoint and application environments.

This is a high-impact opportunity to combine hands-on SOC expertise, threat hunting and detection engineering in a remote-first, pan-European company where security directly supports the resilience and trust of Wero.

About the team

You’ll join the Security Operations team within Operations Services Delivery. The team brings together highly skilled security profiles, including SOC, IAM, general security, threat hunting and penetration testing expertise.

You’ll collaborate closely with Security, Engineering, DevOps, IT and Operations teams to strengthen detection and response capabilities, improve tooling and ensure strong visibility across our environments. This role is ideal for someone who enjoys hands-on investigation, structured incident response and clear communication with both technical and non-technical stakeholders.

Your impact

• Act as a central point of contact for alert triage, incident identification and security event investigation across EPI environments.

• Execute incident response activities using structured frameworks such as SANS PICERL, from preparation and identification through containment, eradication, recovery and lessons learned.

• Conduct proactive, hypothesis-driven threat hunts based on attacker behaviour, emerging threats, threat intelligence and MITRE ATT&CK techniques.

• Parse, analyse and correlate logs from authentication, application, system, endpoint and cloud telemetry sources, including AWS and Azure.

• Design, tune and maintain detection rules, use cases, dashboards, custom alerts and automation workflows to identify anomalies, lateral movement and persistent threats.

• Contribute to the development and continuous improvement of SOC playbooks, runbooks, SIEM and EDR integrations.

• Document and communicate threat findings, incident outcomes and remediation recommendations clearly to technical and non-technical stakeholders.

• Collaborate with engineering, SOC, IR and IT teams to improve detection coverage, response readiness and operational resilience.

Technology stack & way of working

• Primary security tools: Rapid7, Microsoft Defender, SIEM and EDR technologies

• Cloud, identity & operations: AWS, Azure, Microsoft Entra ID, Okta, PagerDuty

• Scripting, querying & automation: Python, PowerShell, KQL, custom alerting and auto-remediation workflows

• Collaboration & delivery: Jira, Confluence, GitHub

To succeed, you should meet at least 70% of these requirements

• +8 years of experience in cybersecurity, with strong hands-on experience as a SOC analyst, incident responder, detection engineer or similar role.

• Fluent in English (CEFR C1 or C2); French, German, Dutch or other European languages are a plus.

• Thrive in a remote-first, multicultural and fast-paced environment.

• Strong familiarity with the full SOC lifecycle, from Tier 1 to Tier 3, including alert triage, incident response, threat hunting and threat intelligence.

• Proven experience in threat hunting, detection engineering or threat intelligence, with the ability to turn attacker behaviours into actionable detections.

• Solid understanding of SIEM and EDR technologies, log parsing, detection engineering and alert tuning.

• Hands‑on experience with scripting and querying tools such as Python, PowerShell or KQL to support automation, investigations and custom alerting.

• Ability to analyse and correlate logs from diverse sources, including authentication, application, system and cloud telemetry across AWS and Azure.

• Knowledge of attacker TTPs, MITRE ATT&CK, threat exposure and attack path analysis.

• Experience creating or improving incident response playbooks, runbooks and automation workflows.

• Strong communication skills, with the ability to explain technical findings and security risks clearly to both technical and non-technical stakeholders.

• Willingness to participate in a 24/7 on-call rotation, approximately one week per month, to support incident response and operational continuity.

Nice to haves

• Experience with Rapid7 and with TaHiTI.

• Familiarity with Microsoft Entra ID and its integration into detection and response workflows.

• Nice-to-have certifications such as GSEC, GCIH, BTL1/2, SC-200 or AZ-500.

• Experience in payments, banking, fintech or another highly regulated environment.

If this looks like you, the recruitment steps are:

1. A first call with one of our recruiters

2. A technical interview with our CISO and a security expert

3. A final interview with our COO

4. Hopefully, an offer you can’t refuse

Turn back if …

• You prefer a purely reactive SOC role where you only handle out-of-the-box alerts and escalations.

• You don’t enjoy digging into logs, building queries, tuning detections or investigating ambiguous signals across distributed systems.

• You are looking for a role with no on-call responsibilities or no operational incident response exposure.

• You prefer working in isolation rather than collaborating with engineering, DevOps, IT and business stakeholders.

What we can offer

• Remote-first culture with quarterly and annual all‑staff in‑person meetups to keep teams connected and collaborative

• Possibility to work from another EU country for up to 3 months per year

• Competitive compensation package, featuring salary, performance-based bonus and a thoughtfully designed, high-quality benefits programme

• The opportunity to be part of a true pan‑European company

• Learning & development budget: €5,000 training budget per year

Our commitment to equal employment opportunities

EPI offers the same job opportunities to all, without distinction of gender, ethnicity, religion, sexual orientation, social status, disability or age. EPI promotes the development of an inclusive work environment that mirrors the diversity of the clients our product is serving.