Detection and Response Engineer

remote work; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Competitive compensation and benefits

Mentorship from Lead

Learning and development opportunities

Job summary

Moniepoint Inc. is seeking an experienced Detection and Response Engineer to join the Incident Response team. You will lead investigations from start to finish, then translate learnings into improved detections and automation across Moniepoint Group.

You will triage security incidents, write and tune detection rules, and drive down MTTD/MTTR while collaborating with cross-functional teams and maturing IR capabilities.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field (or equivalent hands-on experience).
• 2–4 years of incident response, SOC operations, or detection engineering experience.
• Experience writing or tuning detection rules in a SIEM using YARA-L, CQL, KQL, or Sigma.
• Strong SIEM/EDR, log analysis, and end-to-end incident triage capabilities.
• Familiarity with MITRE ATT&CK and its mapping to detection coverage.
• Proficiency in Python, JavaScript, or similar scripting for automation.
• Strong written communication for incident reports and detection docs.

Responsibilities

• Own escalated security incidents end-to-end: scoping, evidence collection, threat analysis, containment, remediation.
• Analyze and reverse engineer malware; extract IOCs and map TTPs for detection.
• Threat hunting using existing content, threat intel, and hypothesis-driven analysis.
• Review and provide feedback on reported security incidents.
• Write, test, and deploy detection rules through CI/CD Detection-as-Code pipeline.
• Tune detections to reduce false positives using findings from investigations.
• Build and maintain SOAR playbooks and automated workflows for triage and response.
• Collaborate with cloud security, infra, and development teams; maintain playbooks and docs.

Skills

Incident response

SOC operations

Detection engineering

Threat hunting

YARA-L/CQL/KQL/Sigma

Python/Automation

MITRE ATT&CK

SIEM/EDR

Education

Bachelor's degree in Cybersecurity/CS/IT or equivalent

Tools

SIEM

EDR

Google SecOps

Job description

Who we are

Moniepoint Inc. is Africa’s all-in-one financial ecosystem, helping 10 million businesses and individuals access seamless payments, banking, credit, and business management tools since 2019.

As Nigeria’s largest merchant acquirer, it powers most of the country’s Point of Sale (POS) transactions. Through its subsidiaries, Moniepoint Inc. processes $22 billion monthly for its customers while operating profitably.

Curious about what makes Moniepoint an incredible place to work? Check out posts on how we cultivate a culture of innovation, teamwork, and growth.

Role Overview:

Moniepoint is looking for an experienced Detection and Response Engineer to join our Incident Response team. The role suits someone who has moved beyond first-line triage and wants to lead investigations from start to finish, then use what they learn to improve our detections. You’ll triage and investigate security incidents, write and tune detection rules in our Detection-as-Code pipeline, and automate detection and response work.

You’ll work closely with the Lead to close detection gaps, drive down MTTD/MTTR, and grow toward deeper detection engineering and IR ownership across Moniepoint Group

Key Responsibilities:

Security Incident Response

• Own escalated security incidents end-to-end, including scoping, evidence collection, threat analysis, containment, and remediation
• Analyze and reverse engineer malware to understand its behavior, extract Indicators of Compromise (IOCs), identify Tactics, Techniques, and Procedures (TTPs), and determine appropriate detection and response
• Conduct threat hunting using existing detection content, threat intelligence, and independent hypothesis-driven analysis
• Review and provide feedback on reported security incidents

Detection Engineering

• Write, test, and deploy detection rules (YARA-L or equivalent) through the team's CI/CD Detection-as-Code pipeline
• Tune existing detections to reduce false positives, using incident and hunting findings as the primary signal for what needs fixing
• Identify detection gaps surfaced during investigations and translate them into new rule proposals
• Build and maintain SOAR playbooks and security automation, including AI-driven and agentic workflows, to automate alert triage, enrich investigations, and speed up incident response.
• Participate in tabletop, purple-team, and threat-intel-driven simulation exercises, including scenario execution and converting findings into new detections
• Translate relevant threat intelligence into new detection opportunities or hunting hypotheses

Collaboration & Documentation

• Work cross-functionally with cloud security, infrastructure, and development teams to close systemic gaps identified during investigations
• Maintain accurate records for incidents, detection changes, and threat intelligence, and keep the playbook library current
• Document new detection logic and rule changes to a standard that supports peer review and audit

Compliance & Continuous Improvement

• Ensure IR and detection engineering practices align with PCI-DSS, ISO 27001, and NIST CSF 2.0
• Stay current with cybersecurity trends and threat landscape shifts, and proactively implement IR or detection process improvements

Log Integration, Visibility, & Threat Modeling

• Drive log source onboarding and ingestion health across enterprise applications and cloud environments; identify critical visibility gaps; and coordinate remediation with relevant teams.
• Lead threat modeling exercises for critical infrastructure and translate findings into high-fidelity detection rules and proactive threat hunting hypotheses
• Implement and maintain automated event enrichment pipelines to enhance context for security investigations and improve analyst efficiency.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field (or equivalent hands-on experience)
• 2 - 4 years of experience in incident response, SOC operations, or detection engineering
• Demonstrated experience writing or tuning detection rules in a SIEM (Google SecOps, or similar), using a rule language such as YARA-L, CQL, KQL, or Sigma
• Solid experience with SIEM and EDR platforms, log analysis, and end-to-end incident triage/investigation
• Working knowledge of MITRE ATT&CK and how it maps to detection coverage
• Comfortable with Python, JavaScript, or a similar scripting language for automation and detection support work
• Strong written communication skills for incident reports and detection documentation

Preferred Skills & Certifications

• Experience with SOAR platforms or building automation for triage/enrichment
• Exposure to multi-cloud environments (GCP, AWS) and fintech/financial-sector threats
• Foundational digital forensics or malware analysis experience
• GCIH, CySA+, or equivalent IR/detection engineering certifications

What We Offer

• A clear path toward senior detection engineering and IR ownership
• Direct mentorship from a Lead who owns the full detection-as-code and automation stack
• Competitive compensation and benefits
• Exposure to real-world fintech security challenges
• The opportunity to build detection capability that protects systems impacting millions of users.

What we can offer you

• Culture -We put our people first and prioritize the well-being of every team member. We’ve built a company where all opinions carry weight and where all voices are heard. We value and respect each other and always look out for one another. Above all, we are human.
• Learning - We have a learning and development-focused environment with an emphasis on knowledge sharing, training, and regular internal technical talks.
• Compensation - You’ll receive an attractive salary, pension, health insurance, annual bonus, plus other benefits.

What to expect in the hiring process

• A preliminary phone call with the recruiter
• A technical interview with a Team Lead
• A behavioural and technical interview with a member of the Executive team.