Security Engineer — Incident Response & DLP Automation

Binance; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Work-from-home options

Equal opportunity employer

Career growth opportunities

Job summary

Binance is seeking a hands-on security engineer with DLP and incident response experience to design and implement scalable security tooling. The role emphasizes automation, custom solutions, and threat detection in a fintech/crypto environment.

You will work across SIEM, EDR, and cloud services, contribute to detection engineering, and participate in on-call rotations, applying data protection techniques to protect user assets.

Qualifications

• 4+ years in a SOC or security operations role with incident response focus.
• Proven experience with DLP design, deployment, and monitoring.
• Strong programming skills (macOS Swift, Unix socket programming, scripting).
• Hands-on threat hunting, forensic analysis, and APT detection experience.
• Familiarity with SIEM, EDR, and cloud security architectures.
• Knowledge of encryption, tokenization, and data classification methods.

Responsibilities

• Design, develop, and maintain security automation and SOC tooling (SIEM/EDR integrations).
• Automate alert enrichment, correlation, response, and investigations workflows.
• Build API-based integrations with security tools and cloud platforms (AWS).
• Support and optimize SIEM ingestion, alerting, and investigations.
• Contribute to detection engineering: log parsing, normalization, detection logic.
• Assist incident response: triage, containment, eradication, post-incident analysis.
• Participate in SOC on-call rotation and incident response duties.
• Collaborate with SOC analysts to scale engineering solutions and CI/CD pipelines.

Skills

DLP design

Incident response

Swift

Unix sockets

Scripting

Threat hunting

Forensic analysis

APT detection

SIEM

EDR

Cloud security

Data encryption

Data tokenization

Data classification

Education

Job description

Binance is seeking a hands-on security engineer with DLP and incident response experience to design and implement scalable security tooling. The role emphasizes automation, custom solutions, and threat detection in a fintech/crypto environment.

You will work across SIEM, EDR, and cloud services, contribute to detection engineering, and participate in on-call rotations, applying data protection techniques to protect user assets.