Security Operations Engineer

Yellow Card; United States; Remote; USD 120,000 - 160,000; Full time

Job summary

Yellow Card is a global, fully remote organization providing Stablecoin infrastructure. We seek a Security Operations Engineer to own detection design, triage, automated response, and cloud posture across AWS and EKS.

You’ll collaborate with DevOps, Engineering, and GRC to drive automation and reduce manual effort through detection-as-code. The role focuses on designing SIEM rules, building SOAR playbooks, managing vulnerability triage, and maintaining posture metrics.

Qualifications

• Experience designing detection rules for SIEM platforms using signature-based and behavioural logic.
• Experience with AWS and EKS security posture management.
• Ability to write detection logic and own end-to-end remediation in containerised environments.
• Familiarity with MITRE ATT&CK framework and threat intel integration.
• Experience building automation and SOAR playbooks for alert handling.

Responsibilities

• Design and maintain SIEM detection rules across cloud, container, identity, and application layers.
• Integrate threat intelligence feeds and maintain a structured detection backlog.
• Triage alerts; reduce false positives through tuning and documented rationale.
• Build and maintain SOAR playbooks for IAM anomalies, misconfigurations, and container events.
• Automate enrichment steps and document automation logic; track coverage with KPIs.
• Own end-to-end vulnerability triage for cloud and container environments; coordinate remediation with engineering.
• Maintain posture tracking and reporting for SOC and cloud domains; support executive dashboards and GRC evidence.

Skills

SIEM rules

SOAR playbooks

AWS security

EKS security

Threat intelligence

Vulnerability triage

Incident response

IAM governance

Job description

Who We Are Yellow Card is the largest licensed Stablecoin-based infrastructure provider operating across over 60 countries. From Stablecoin payment infrastructure to fiat settlement rails, wallet services, and custom local Stablecoin issuance, Yellow Card provides the complete infrastructure businesses need to manage Stablecoins, payments, and operations across 50 emerging markets. Yellow Card operates with a substantial global team spanning 24 countries. This workforce is characterized by its linguistic diversity, with collective speaking of over 25 languages, underscoring the company’s extensive international reach.

The Security Operations Engineer is the operational backbone of the Security Operations Centre (SOC). It is a fully remote, hands-on, technical role that owns three tightly integrated domains: security alert design, triaging, and automated response; cloud security posture management across EKS and AWS environments; and posture tracking and reporting. Reporting to the Associate Director, Product & Infrastructure Security, the engineer works alongside a mature Application Security team and collaborates closely with DevOps, Engineering, and Security GRC functions. The role sits within the First Line of Defense and is expected to progressively drive down manual effort through detection-as-code and SOAR automation. This is not a perimeter-security or scan-and-report role. The right candidate must be comfortable writing detection logic, triaging cloud misconfigurations at the infrastructure level, and owning end-to-end vulnerability remediation cycles in containerised environments.

What You'll Do

1. Security Operations

   Alert design and coverage

   Design and maintain SIEM detection rules covering cloud, container, identity, and application layers, using both signature-based and behavioural logic Map detection coverage against the MITRE ATT&CK framework and identify gaps relevant to the organisation's AWS and EKS attack surface

   Integrate threat intelligence feeds to refresh rule logic for emerging threats and TTPs Maintain a detection backlog, prioritised by risk, with defined review cadences

   Alert triage Daily SIEM alert triage following defined response timing standard Classify, investigate, and resolve security signals; Reduce false-positive rates through structured tuning cycles, with documented rationale for rule changes

   Automated response workflows (SOAR)

   Build and maintain SOAR playbooks for common alert types including IAM anomalies, misconfiguration alerts, exposed secrets, and container runtime events

   Automate enrichment steps (asset lookup, threat intel correlation, ownership resolution) to reduce analyst time-to-context Document automation logic and maintain version control for all playbooks Measure and report automation coverage rate as a standing KRI

2. Cloud Security Posture Management

   Vulnerability management

   Own the end-to-end vulnerability triage process for cloud and container environments, prioritising findings by business impact using CVSS scoring, asset criticality, and exploitability context Manage EKS-specific vulnerability coverage: base image currency, workload scanning results, pod security standards compliance, and node group patching cadence Coordinate remediation with engineering teams by opening well-scoped tickets, tracking progress, and escalating SLA breaches Maintain MTTR and SLA compliance data by severity tier Oversee CSPM posture score targets; triage new Critical findings within defined SLA windows

   Identity and access governance

   Review and approve IAM policy changes, enforcing least-privilege and flagging over-permissioned roles or service accounts Execute scheduled IAM hygiene reviews: unused credentials, stale access keys, overly broad policies, and cross-account trust boundaries Govern workload identity configurations in EKS, ensuring service accounts carry only the permissions required Support the secrets rotation program and enforce zero hardcoded credentials across the estate Configuration and change management Review and approve cloud network security changes: security group modifications, network ACL changes, and routing updates Own container image security: base image update cadence, scanning results review, and image ownership classification Investigate and remediate misconfiguration alerts surfaced by CSPM tooling within defined SLA windows Maintain a configuration baseline for critical cloud resources and flag drift

3. Posture Tracking and Reporting

   The engineer is the primary data owner for security posture metrics across both SOC and cloud domains. Reporting outputs feed executive dashboards, GRC compliance evidence, and quarterly risk reviews. KRI data collection Collect and maintain Key Risk Indicator data across all three KRA domains on defined cadences SOC KRIs: MTTA (Mean Time to Acknowledge), MTTR, false-positive rate, automation coverage rate, detection coverage score VM KRIs: Critical/High finding counts, SLA compliance rate by severity, MTTR by tier, overdue remediation count Posture KRIs: CSPM score, under-protected asset count, misconfiguration closure rate, IAM hygiene score, log source coverage Recurring control reviews Execute infrastructure security control checks on weekly (CSPM critical findings), monthly (IAM hygiene, secrets rotation status), and quarterly (posture benchmark, detection coverage review) cadences Produce structured findings reports for each review cycle, flagging control failures for escalation Reporting Provide SOC and cloud posture m