Security Operations Engineer - Cloud & SOAR Automation

Yellow Card; Tulsa (OK); On-site; USD 120,000 - 160,000; Full time

Job summary

Yellow Card is seeking a Security Operations Engineer to join our fully remote SOC team. You will own detection design, triage, and automated response across cloud, containers, and identity layers in a dynamic FinTech environment.

You’ll work with DevOps, Engineering, and GRC to reduce manual work through detection-as-code and SOAR automation while maintaining CSPM posture, vulnerability triage, and incident response across AWS EKS and serverless resources.

Qualifications

• Fluent English, written and verbal.
• ],
• job_responsibilities_description
• [

Responsibilities

• Design and maintain SIEM detection rules across cloud, container, identity, and app layers.
• Daily SIEM alert triage with defined response timing; reduce false positives.
• Build and maintain SOAR playbooks for IAM anomalies, misconfigurations, exposed secrets, and container runtime events.
• Automate enrichment steps (asset lookup, threat intel correlation, ownership resolution) to reduce analyst time-to-context.
• Document automation logic and maintain version control for all playbooks.
• Measure and report automation coverage rate as a standing KRI.
• Oversee CSPM vulnerability triage and remediation coordination with engineering teams.
• Review IAM policies for least privilege; perform hygiene reviews and cross-account trust checks.

Skills

English fluency

Cross-functional collaboration

Security operations

Cloud security

AWS security

Kubernetes security

EKS security

SIEM operations

Vulnerability management

IaC security

Incident response

FinTech experience

Detection rule tuning

Written communication

Remediation coordination

Startup environment

Tools

Datadog

Wiz

Orca Security

Terraform

CloudFormation

AWS Secrets Manager

Job description

Yellow Card is seeking a Security Operations Engineer to join our fully remote SOC team. You will own detection design, triage, and automated response across cloud, containers, and identity layers in a dynamic FinTech environment.

You’ll work with DevOps, Engineering, and GRC to reduce manual work through detection-as-code and SOAR automation while maintaining CSPM posture, vulnerability triage, and incident response across AWS EKS and serverless resources.