Remote Security and Threat Ops Engineer — Stock Options

One; United States; On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Remote-friendly US

Flexible time off

Stock options

Health benefits

401(k) with company match

Job summary

OnePay is seeking a Security and Threat Operations Engineer to protect its fast-moving fintech platform. You will build detections, monitor cloud and API activity, and harden our environment while collaborating with product, platform, and engineering teams.

You will design Python-based tooling for faster investigations, triage incidents, and respond to vulnerabilities across Wiz, cloud and on‑prem infrastructure.

Qualifications

• 5+ years in information security, threat detection, or security operations.
• Strong Python skills for automation and tooling.
• Experience with SIEM/detection platforms and cloud telemetry.

Responsibilities

• Build detections and monitoring across cloud, application, identity, and edge environments.
• Review API traffic, authentication flows, and WAF telemetry for anomalies.
• Develop Python-based tooling for investigations and automation.
• Triage and remediate findings from Wiz and vulnerability scans.
• Translate threat models into production detections and response playbooks.
• Investigate security events end to end and coordinate remediation.
• Support PCI and SOC 2 compliant vulnerability practices.
• Participate in 24x7 on-call security incident response.

Skills

Threat detection

Security operations

Python

Cloud security (AWS)

WAF security

SIEM / detection

AI in security workflows

Cross-functional collaboration

Tools

CloudWatch

Datadog

Kubernetes

Wiz

Job description

OnePay is seeking a Security and Threat Operations Engineer to protect its fast-moving fintech platform. You will build detections, monitor cloud and API activity, and harden our environment while collaborating with product, platform, and engineering teams.

You will design Python-based tooling for faster investigations, triage incidents, and respond to vulnerabilities across Wiz, cloud and on‑prem infrastructure.