Cyber security engineer in payments

Paymentsense; Greater London; On-site; GBP 80,000 - 120,000; Full time

Job summary

Paymentsense ищет инженера кибер-угроз для роли в Cyber Defence Centre. Вы будете связывать инженерные решения безопасности и операции реагирования на инциденты, владеть инструментами и вести активное обнаружение и ответ на инциденты по всем слоям инфраструктуры.

Вы будете развивать и оптимизировать инструменты безопасности, строить детекционные правила и плейбуки SOAR, а также проводить анализ причин инцидентов и наставлять команду в практиках автоматизации.

Qualifications

• Опыт в инженерии безопасности или реагировании на инциденты в динамичных условиях.
• Практика SIEM и SOAR; опыт Google SecOps приветствуется.
• Умение писать скрипты (Python, Go) и поддерживать IaC конвейеры.
• Опыт работы в облаке (GCP и AWS).
• Знание угроз, TTP и анализ причин инцидентов.

Responsibilities

• Триаж сигналов тревоги и координация инцидентов.
• Проактивный threat hunting по сети, endpoint и облаку.
• Обслуживание и оптимизация инструментов безопасности (SIEM, EDR, SOAR).
• Обновление IaC пайплайнов и обеспечение применения настроек безопасности.
• Построение правил детекции и SOAR плейбуков.
• Поиск пробелов в видимости и развитие SOC.

Skills

SIEM

SOAR

Python

Go

GCP

AWS

Threat hunting

IR

Tools

SIEM

SOAR

Job description

Описание:

As a Cyber Threat Engineer within our Cyber Defence Centre, you will bridge the gap between security engineering and incident response operations. You will champion the health, optimization, and evolution of our security tooling while leading active detection and response efforts. In this pivotal role, you will take ownership of safeguarding our systems and collaborate across teams to protect our mission as we transform the payments sector.

Задачи:

• Triage alerts, coordinate end-to-end security incident management, and conduct root cause analysis.
• Conduct proactive threat hunting across network, endpoint, and cloud environments to uncover hidden threats.
• Maintain and optimize critical security tooling (SIEM, EDR, SOAR).
• Maintain and update our Infrastructure as Code (IaC) pipelines to ensure security configurations and tools are consistently applied and managed.
• Build high-fidelity detection rules and design SOAR playbooks to automate workflows and enrich alerts.
• Identify visibility gaps and engineer solutions to continually advance our security operations capabilities.
• Mentor team members in automation practices and produce insightful metrics and reporting dashboards.

Требования:

• Proven background in Security Engineering or Incident Response within fast-paced environments.
• Hands-on expertise with SIEM and SOAR platforms, with Google SecOps experience strongly preferred.
• Proficiency in scripting (e.g., Python, Go) and maintaining Infrastructure as Code (IaC) pipelines.
• Strong experience working within cloud environments, particularly Google Cloud Platform (GCP) and AWS.
• Deep understanding of threat actors, TTPs, and a structured approach to root cause analysis.
• Strong collaborative skills to partner across teams, understand attack surfaces, and drive security improvements.

Условия:

We believe our best work happens when we collaborate in-person. These “together days” foster communication, drive innovation and spark our brightest ideas. That's why we have an office-first culture. This means working from the office 4+ days per week. With offices across Europe, we know a thing or two about staying dynamic. Need deep focus? Head to a quiet zone. Big ideas? Collaboration spaces have you covered. Just here for a catch-up? Our social hubs make it easy. Do work that counts, in spaces made for you.