Security Engineer III - Detection & Response

Primer; United Kingdom; Remote; GBP 85,000 - 125,000; Full time

Benefits offered by this job

Fully remote globally distributed

Competitive share options

Flexible holiday: 25 days

Co‑working space access across major城市

Workations & Company Retreat

Best equipment for your role

£500 towards home office setup

Generous learning budget

Private Medical Insurance

Job summary

Primer is seeking a Security Engineer to own detection and response across cloud and SaaS environments. You will build detections in Elastic, tune rules, and automate responses using Python, Terraform and related tools.

You’ll collaborate with Application/Security teams to shape product security and drive IR playbooks, while working in a fully remote, globally distributed culture that values fast, rigorous security work.

Qualifications

• Experience responding to security incidents from alert through write‑up.
• Hands‑on detection tuning in a SIEM (Elastic, Splunk) using MITRE ATT&CK.
• Experience with cloud‑native detection and response in AWS or Google Cloud.
• Comfortable with Python or Go for scripting and automation.
• Clear, structured written communication under pressure.

Responsibilities

• Build, tune and maintain detections in our SIEM (Elastic) and onboard log sources.
• Find gaps in detections and prune/remodel rules to reduce noise.
• Use Python and Terraform to build and maintain the infrastructure behind detections.
• Own investigation: triage, investigate, elevate and resolve security incidents.
• Lead routine incidents end‑to‑end and inform stakeholders during larger events.
• Build runbooks and automations to cut manual work in triage and response.
• Join our on‑call rotation for incident response and monitoring.
• Document risk decisions and keep controls audit‑ready (SOC 2, PCI DSS).
• Leverage AI tools to speed detection/response, with healthy skepticism.

Skills

Incident response

SIEM tuning

Python

Go

Cloud security

Tools

Elastic SIEM

Splunk

Terraform

Tines

Job description

An Introduction to Primer

Primer is the unified infrastructure for global payments. We give finance and payments teams the visibility and control to reduce complexity, improve performance, and capture more revenue - all from a single platform. Backed by Sofina, Peak XV Partners, ICONIQ, Tencent, Accel, and Balderton, we're building the payments layer the world's best companies rely on.

Watch our showcase >

Read up on our $100m Series C

Learn more about our culture >

Primer processes payments for some of the world's best companies, which makes us an attractive target and means getting detection and response right really matters. We're looking for a Security Engineer to join our Detection & Response function and own a meaningful slice of how we detect, investigate and respond to threats across our cloud infrastructure and SaaS estate.

You’ll write and tune the detections in our SIEM, build the automation that speeds up how we react, and be a first responder when something looks wrong. You’ll have real ownership of the areas you work on, and the freedom to shape how we detect and respond to threats across them.

You’ll also work closely with our Application Security/Product Security engineers: what we learn from detections and incidents shapes how we build, and what they know about our products shapes what we look for.

What you'll be doing

Detection

• Build, tune and maintain detections in our SIEM (Elastic), and identify opportunities to onboard new log sources (e.g. AWS, Google Workspace, Kubernetes) and build new detections on top of them.

• Find what our current detections miss, and keep the rule set lean by removing what no longer adds value.

• Use Python and Terraform to build and maintain the infrastructure behind your detections and tooling.

Response

• Own investigation: triage, investigate, elevate and resolve security incidents, and write up findings clearly enough to stand on their own

• Lead routine incidents end to end, and take a clear role in larger ones, whether that’s driving the investigation or keeping stakeholders informed

• Build runbooks and automations (Python, Tines or similar) to cut manual work out of triage and response

• Join our on-call rotation for incident response and monitoring

Across both

• Make and document risk decisions in your area, and know when to pull in others.

• Keep the controls you own audit-ready and contribute evidence for audits (e.g. SOC 2, PCI DSS).

• Use AI tools to work faster across detection and response, from drafting rules and queries to summarising investigations, while maintaining a healthy level of scepticism.

What we're looking for

• Real experience responding to security incidents, from first alert through to write-up

• Hands‑on experience writing and tuning detections in a SIEM (Elastic, Splunk or similar), using frameworks like MITRE ATT&CK to reason about coverage

• Experience with cloud‑native detection and response in AWS or Google Cloud

• Comfortable with Python or Go for scripting and automation

• Clear, structured written communication, including under pressure

Nice to have

• Experience with Terraform or other infrastructure-as-code

• Experience with no‑code security automation or SOAR‑style tooling

• Exposure to compliance frameworks like PCI DSS, SOC 2 or ISO27001

• Background in fintech, payments or another regulated industry

• Experience using AI tools or agents in security work, and a clear view of where they help and where they don't

A typical interview process

• An initial intro call with a Talent Partner

• An interview with the Hiring Manager

• Challenge Stage - Contextualised to the role

• A final, values‑alignment interview

What's the culture like at Primer?

We're building a culture where people can do their best work and be proud of the impact they have. You'll be working with people who are mission‑driven, smart, and reflective, and who are genuinely invested in building exceptional products and delivering success for our merchants. We work remotely, and have done since day one. We believe that building a successful, profitable company goes beyond proximity. We invest in our relationships through great remote working practices and thoughtfully designed face‑to‑face time, including workations, our annual company retreat, and access to co‑working spaces across most major cities. The work is challenging. Scaleups are a challenge, and building category‑defining products is a challenge. But there's a meaningful difference between a challenge and a struggle. At Primer, the right challenge comes with the right support: strong onboarding, a collaborative environment, and a team that is genuinely invested in your success. It's never something you face alone.

Our benefits

• We are fully remote and globally distributed; and have been since day one
• Competitive share options
• Flexible holiday, with 25 days minimum to be taken
• Co‑working space access across major cities
• Workations & Company Retreat
• The best equipment for your role
• £500 towards your home office setup
• Generous learning budget
• Private Medical Insurance
• A broad set of additional perks and benefits (depending on location)

Don’t meet every single requirement?

At Primer, we're dedicated to building a diverse, inclusive, and authentic workplace. If you're excited about this role but your experience doesn't align perfectly with every qualification listed, we encourage you to apply. You may be the right candidate for this or other roles.

Primer is committed to the equal treatment of all current and prospective employees and adopts a zero‑tolerance approach to discrimination, regardless of age, disability, sex, sexual orientation, pregnancy and maternity, race or ethnicity, religion or belief, gender identity, marriage and civil partnership, or any other background or belief.