Security engineer in detection and response

Sezzle; United States; Remote; USD 56,000 - 106,000; Full time

Job summary

Sezzle ищет Senior Security Engineer, Detection & Response, для усиления операций безопасности и защиты облачных инфраструктур и приложений Sezzle. В обязанности входит развитие SIEM/XDR, разработка детекций и расследование инцидентов, а также управление уязвимостями и проактивные охоты за угрозами.

Кандидату потребуется 6+ лет опыта в кибербезопасности, знание AWS, Linux, Kubernetes, а также работа с SIEM и процессами соответствия PCI DSS/SOC 2.

Qualifications

• 6+ лет опыта в области кибербезопасности, разработки или инфраструктуры с практическим опытом защиты облачных систем.
• Опыт работы с SIEM-платформами (Wazuh, Splunk, ELK) для детекции, мониторинга и реагирования.
• Умение проектировать и настраивать правила детекции, снижать шум в алертинге и улучшать процессы расследования.
• Сильные знания AWS, Linux и Kubernetes, включая безопасность архитектуры и эксплуатационные практики.
• Опыт управления уязвимостями: сканирование, триаж, координация remediation с командами разработки.
• Знания PCI DSS и SOC 2, включая требования к логированию и мониторингу.
• Навыки атрибуции событий к людям/работе через логи и телеметрию.
• Опыт применения ИИ в операциях безопасности, практические применения и ограничения.

Responsibilities

• Построение и развитие SIEM/XDR, включая сбор логов, разработку правил, настройку алертинга и расследований.
• Разработка стратегий детекции подозрительной активности, включая эксфильтрацию данных.
• Расширение охвата аудита и атрибуции: Kubernetes logs, логи БД, SSO телеметрия.
• Расследование и реагирование на инциденты в облаке и приложениях, анализ причин и долговременные исправления.
• Проведение проактивных охот за угрозами в облаке и идентификационных планах.
• Внедрение управления уязвимостями по инфраструктуре, платформам и приложениям, в том числе через работу с инцидентами.
• Квалификация внешних находок (bug bounty) и координация remediation.
• Участие в моделировании угроз и обзорах безопасности при проектировании систем.
• Применение AWS и Kubernetes-решений для защиты систем и консультации команд владельцев.
• Сопровождение соответствия требованиям PCI DSS, SOC 2 — ведение журналирования и доказательств аудита.
• Разработка автоматизации и использования ИИ для повышения эффективности операций безопасности.
• Участие в дежурстве по обнаружению и реагированию на инциденты.

Skills

SIEM platforms

Detection rules

Vulnerability management

AWS

Linux

Kubernetes

Incident response

Cloud security

AI tooling in security

Logging and telemetry

Threat modeling

Compliance (PCI DSS, SOC 2)

Tools

Wazuh

Splunk

ELK

Snyk

Trivy

Grype

Job description

Описание

We are seeking a hands-on, high-impact Senior Security Engineer, Detection & Response, to strengthen security operations at Sezzle detection, incident response, and vulnerability management across our cloud infrastructure and applications.

Задачи

• Build, operate, and mature SIEM/XDR capabilities, including log ingestion, detection rule development, alert tuning, and investigation workflows
• Design and implement detection strategies for suspicious activity, including data exfiltration patterns using application and database telemetry
• Extend audit and attribution coverage across the estate — Kubernetes audit logs, database audit logging, SSO and access-path telemetry — so access to sensitive data is attributable to a person or workload, with retention aligned to compliance requirements
• Investigate and respond to security incidents across cloud infrastructure and applications, performing root cause analysis and driving long-term fixes
• Run proactive threat hunts across cloud and identity planes, building agentic hunting workflows that make hunts repeatable
• Operate vulnerability management across infrastructure, platforms, and applications - including internal scans, dependency analysis, and external findings, validating true positives and driving remediation with engineering teams
• Triage and validate external security findings (including bug bounty reports), distinguishing true positives and coordinating remediation
• Contribute to threat modeling and security design reviews for the detection, logging, and incident-response implications of new systems
• Apply strong AWS and Kubernetes judgment to secure the systems you operate and advise owning teams on remediation
• Support and implement security controls aligned with PCI DSS, SOC 2, and other compliance requirements — with your logging and detection work producing the audit evidence as a by-product
• Develop and implement automation (including AI) to improve efficiency in security operations, detection, and response
• Participate in the on‑call rotation for detection and response and the services you own

Требования

• 6+ years of experience in security, software, or infrastructure engineering, with hands‑on experience securing cloud‑based production systems and working with real‑world security challenges
• Experience working with SIEM platforms (e.g., Wazuh, Splunk, ELK) for detection engineering, monitoring, and incident response
• Experience designing and tuning detection rules, reducing alert noise, and improving investigation workflows
• Strong hands‑on experience in vulnerability management — scanning, triage and validation of scanner and bug‑bounty findings, remediation coordination, and verification
• Strong knowledge of AWS, Linux, and Kubernetes infrastructure, including security architecture and operational best practices
• Ability to investigate issues directly using logs, cloud tooling, and system‑level data
• Experience assessing the detection and logging implications of new systems in design reviews
• Knowledge of common security vulnerabilities and mitigation strategies (OWASP, SANS, etc.)
• Working knowledge of compliance frameworks such as PCI DSS and SOC 2, particularly logging, monitoring, and evidence expectations
• Demonstrated AI‑forward engineering you actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) in your work today, and have opinions grounded in practice about where it helps and where it doesn't

Будет плюсом

• You have built AI‑assisted workflows that others adopted — triage, enrichment, or hunting
• Familiarity with log‑based detection, telemetry pipelines, and security analytics use cases
• Experience with internal penetration testing or adversarial exercises, and translating results into detection and remediation work
• Strong understanding of cloud‑native security controls, including IAM, network segmentation, and container security
• Experience with container and dependency security tools (e.g., Snyk, Trivy, Grype) as an operator of their findings
• Experience aligning technical security work with regulatory and compliance expectations
• Experience in fintech, payments, or other regulated environments

Условия

For this principal development role, with 6+ years of experience, the compensation range is $5,000 - $9,500 USD per month, based on experience level and gross amount.

#Full-time