Remote Cloud Security Operations Engineer (SIEM/SOAR/CSPM)

Yellow Card; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

Yellow Card is a global, fully remote organization providing Stablecoin infrastructure. We seek a Security Operations Engineer to own detection design, triage, automated response, and cloud posture across AWS and EKS.

You’ll collaborate with DevOps, Engineering, and GRC to drive automation and reduce manual effort through detection-as-code. The role focuses on designing SIEM rules, building SOAR playbooks, managing vulnerability triage, and maintaining posture metrics.

Qualifications

• Experience designing detection rules for SIEM platforms using signature-based and behavioural logic.
• Experience with AWS and EKS security posture management.
• Ability to write detection logic and own end-to-end remediation in containerised environments.
• Familiarity with MITRE ATT&CK framework and threat intel integration.
• Experience building automation and SOAR playbooks for alert handling.

Responsibilities

• Design and maintain SIEM detection rules across cloud, container, identity, and application layers.
• Integrate threat intelligence feeds and maintain a structured detection backlog.
• Triage alerts; reduce false positives through tuning and documented rationale.
• Build and maintain SOAR playbooks for IAM anomalies, misconfigurations, and container events.
• Automate enrichment steps and document automation logic; track coverage with KPIs.
• Own end-to-end vulnerability triage for cloud and container environments; coordinate remediation with engineering.
• Maintain posture tracking and reporting for SOC and cloud domains; support executive dashboards and GRC evidence.

Skills

SIEM rules

SOAR playbooks

AWS security

EKS security

Threat intelligence

Vulnerability triage

Incident response

IAM governance

Job description

Yellow Card is a global, fully remote organization providing Stablecoin infrastructure. We seek a Security Operations Engineer to own detection design, triage, automated response, and cloud posture across AWS and EKS.

You’ll collaborate with DevOps, Engineering, and GRC to drive automation and reduce manual effort through detection-as-code. The role focuses on designing SIEM rules, building SOAR playbooks, managing vulnerability triage, and maintaining posture metrics.