Security Engineer III - Security Operations

Primer.io; United States; Remote; USD 140,000 - 190,000; Full time

Job summary

Primer is seeking a Security Engineer to detect, investigate, and respond to threats across our cloud infrastructure. You will own a meaningful slice of detection and response capability, tuning Elastic SIEM rules, building automation in Python, and contributing to runbooks and on-call incident response.

You will work with AWS, Terraform, and no-code automation tools (Zapier/Tines) to close coverage gaps, write up findings, and support audits (SOC 2, PCI DSS).

Qualifications

• Hands-on experience building and tuning detections in a SIEM (Elastic preferred).
• Experience with AWS and cloud-native detection and response.
• Comfortable with Python scripting/automation; familiarity with IaC (Terraform).
• Knowledge of MITRE ATT&CK and incident triage/resolution.

Responsibilities

• Plan and deliver end-to-end detection and response work within ownership area.
• Build, tune and maintain detections across SIEM and AWS environments.
• Own investigation queue: triage, investigate, elevate and resolve security incidents.
• Build runbooks and automations (Python, Zapier, Tines) to reduce manual triage work.
• Support audits by contributing evidence and maintaining controls for compliance.

Skills

SIEM tuning

Elastic SIEM

AWS cloud

Python scripting

Terraform

MITRE ATT&CK

Incident response

Written communication

Tools

Elastic SIEM

AWS

Zapier

Tines

Terraform

Job description

An Introduction to Primer

Primer is the unified infrastructure for global payments. We give finance and payments teams the visibility and control to reduce complexity, improve performance, and capture more revenue - all from a single platform.

Backed by Sofina, Peak XV Partners, ICONIQ, Tencent, Accel, and Balderton, we're building the payments layer the world's best companies rely on.

Watch our showcase >

Read up on our $100m Series C

Learn more about our culture >

Primer is looking for a Security Engineer to help us detect, investigate, and respond to threats across our cloud infrastructure. You'll take ownership of a meaningful slice of our detection and response capability — tuning what our SIEM catches, building the automation that speeds up how we react, and being a first responder when something looks wrong.

What you'll be doing

• Plan and deliver detection and response work end-to-end — from a new detection rule to a fully automated response — within your area of ownership.
• Build, tune and maintain detections across our SIEM (Elastic) and AWS environment, closing gaps that existing coverage misses.
• Own an investigation queue: triage, investigate, elevate and resolve security incidents, and write up findings clearly enough to stand on their own.
• Build runbooks and automations (Python, and no-code tools like Zapier or Tines) to cut manual work out of triage and response.
• Make and document risk decisions in your area, and know when to pull in others.
• Support our compliance programme by keeping the controls you own audit-ready and contributing evidence for audits (e.g. SOC 2, PCI DSS).
• Use Terraform and Python to build and maintain the infrastructure behind your detections and tooling.
• Join our on‑call rotation for incident response and monitoring.

What we're looking for

• Hands‑on experience building and tuning detections in a SIEM (Elastic preferred; Splunk, Sentinel or similar also welcome)
• Experience with AWS and cloud-native detection and response
• Comfortable with Python for scripting and automation
• Experience with Terraform or other infrastructure‑as‑code
• Working knowledge of MITRE ATT&CK
• Real experience triaging, investigating and resolving security incidents
• Clear, structured written communication

Nice to have

• Experience with no‑code security automation / SOAR‑style tooling
• Exposure to compliance frameworks like PCI DSS, SOC 2 or ISO 27001
• Background in fintech, payments or another regulated industry

A typical interview process

• An initial intro call with a Talent Partner
• An interview with the Hiring Manager
• Challenge Stage - Contextualised to the role
• A final, values‑alignment interview

What's the culture like at Primer?

We're building a culture where people can do their best work and be proud of the impact they have. You'll be working with people who are mission‑driven, smart, and reflective, and who are genuinely invested in building exceptional products and delivering success for our merchants.

We work remotely, and have done since day one. We believe that building a successful, profitable company goes beyond proximity. We invest in our relationships through great remote working practices and thoughtfully designed face‑to‑face time, including workations, our annual company retreat, and access to co‑working spaces across most major cities.

The work is challenging. Scaleups are a challenge, and building category‑defining products is a challenge. But there's a meaningful difference between a challenge and a struggle. At Primer, the right challenge comes with the right support: strong onboarding, a collaborative environment, and a team that is genuinely invested in your success. It's never something you face alone.

Our benefits

• We are fully remote and globally distributed; and have been since day one
• Competitive share options
• Uncapped holiday, with 25 days minimum to be taken
• Co‑working space access across major cities
• Workations & Company Retreat
• The best equipment for your role
• £500 towards your home office setup
• Generous learning budgetPrivate Medical Insurance
• A broad set of additional perks and benefits (depending on location)

Don't meet every single requirement?

At Primer, we're dedicated to building a diverse, inclusive, and authentic workplace. If you're excited about this role but your experience doesn't align perfectly with every qualification listed, we encourage you to apply. You may be the right candidate for this or other roles.

Primer is committed to the equal treatment of all current and prospective employees and adopts a zero‑tolerance approach to discrimination, regardless of age, disability, sex, sexual orientation, pregnancy and maternity, race or ethnicity, religion or belief, gender identity, marriage and civil partnership, or any other background or belief.