Remote Security Engineer: Detection & Response Lead

Primer; United Kingdom; Remote; GBP 85,000 - 125,000; Full time

Benefits offered by this job

Fully remote globally distributed

Competitive share options

Flexible holiday: 25 days

Co‑working space access across major城市

Workations & Company Retreat

Best equipment for your role

£500 towards home office setup

Generous learning budget

Private Medical Insurance

Job summary

Primer is seeking a Security Engineer to own detection and response across cloud and SaaS environments. You will build detections in Elastic, tune rules, and automate responses using Python, Terraform and related tools.

You’ll collaborate with Application/Security teams to shape product security and drive IR playbooks, while working in a fully remote, globally distributed culture that values fast, rigorous security work.

Qualifications

• Experience responding to security incidents from alert through write‑up.
• Hands‑on detection tuning in a SIEM (Elastic, Splunk) using MITRE ATT&CK.
• Experience with cloud‑native detection and response in AWS or Google Cloud.
• Comfortable with Python or Go for scripting and automation.
• Clear, structured written communication under pressure.

Responsibilities

• Build, tune and maintain detections in our SIEM (Elastic) and onboard log sources.
• Find gaps in detections and prune/remodel rules to reduce noise.
• Use Python and Terraform to build and maintain the infrastructure behind detections.
• Own investigation: triage, investigate, elevate and resolve security incidents.
• Lead routine incidents end‑to‑end and inform stakeholders during larger events.
• Build runbooks and automations to cut manual work in triage and response.
• Join our on‑call rotation for incident response and monitoring.
• Document risk decisions and keep controls audit‑ready (SOC 2, PCI DSS).
• Leverage AI tools to speed detection/response, with healthy skepticism.

Skills

Incident response

SIEM tuning

Python

Go

Cloud security

Tools

Elastic SIEM

Splunk

Terraform

Tines

Job description

Primer is seeking a Security Engineer to own detection and response across cloud and SaaS environments. You will build detections in Elastic, tune rules, and automate responses using Python, Terraform and related tools.

You’ll collaborate with Application/Security teams to shape product security and drive IR playbooks, while working in a fully remote, globally distributed culture that values fast, rigorous security work.