Senior Detection Engineer | SecOps

Arqfinance; New York (NY); Hybrid; USD 160,000 - 210,000; Full time

Benefits offered by this job

Competitive salary and benefits

Stock options, so you own part of what

Discretionary performance bonus

The latest tools and technology

A world-class team that will challenge

The opportunity to help build the best

Office Policy: 3-4 days a week in‑line

Job summary

ARQ is seeking a Senior Detection Engineer to own end-to-end detection engineering within a Datadog Cloud SIEM. You’ll map coverage to MITRE ATT&CK, onboard log sources, and build automated detections with CI pipelines and version control.

You’ll work with a small global security team, review AI-assisted outputs, and continuously improve detection coverage while reducing false positives. Hybrid work in multiple cities.

Qualifications

• 5+ years in security with 3+ years owning detections in production.
• Hands-on experience with a cloud SIEM and its query language.
• Deep knowledge of AWS logs (CloudTrail, IAM) and SaaS audit logs.
• Experience mapping detections to MITRE ATT&CK and testing rules.
• Python for automation and security tooling.
• Incident response experience and documentation.
• Strong written and spoken English.

Responsibilities

• Own detection engineering end to end in Datadog Cloud SIEM.
• Write, test and tune detection rules to reduce false positives.
• Map coverage to MITRE ATT&CK and validate by reproducing activity.
• Manage detections as code with version control and CI pipelines.
• Build automation and AI agents for rule authoring and validation.
• Investigate security incidents and write incident reports.
• Help develop automated response and containment capabilities.
• Track and report detection coverage and response performance to security leadership.

Skills

Senior security experience

Cloud SIEM expertise

MITRE ATT&CK mapping

Detections as code

Python automation

Incident response

English communication

Tools

Datadog Cloud SIEM

Splunk

Elastic

Terraform

Git

Job description

We are building the financial system for the next century. One where control sits in the hands of customers — not banks. Where money moves on rails that are faster, smarter, and radically more efficient. Where wealth management tools help you grow your savings for decades — and build generational wealth. Where fewer intermediaries mean more value stays where it belongs: in our customers’ pockets.

We operate with long-term ambition and absolute conviction. We are not here to iterate on the past — we are here to redesign it. This is a defining moment to join us.

We are building what we believe will become one of the most important financial institutions in the world. That requires exceptional talent, relentless standards, and people who care deeply about the work. At ARQ, we are turning the financial system upside down — starting in the Americas. We are nimble, but ambitious. We move fast, learn fast, and innovate relentlessly. Technology is our greatest ally, and execution is our edge. We build as a team. We think long term. We aim for world-class in everything we do. If you are exceptional at what you do — and ready to help redefine finance — we’d love to meet you. Are you ready to build what comes next?

About the team

We believe that small teams of exceptional people outcompete massive companies with mediocre talent. That’s why we have assembled a group of people who have done it before at iconic companies like Revolut, Apple, Uber, Amazon, and Block. We’ve owned some of the most loved and profitable products in the world, delivered transaction platforms operating at massive scale, created beautiful mobile applications — and built things that have changed the lives of millions of people.

We don’t believe in 9-to-5 and we don’t believe in work-life balance as most companies sell it. We believe building the largest financial institution in the world takes long hours, every day, for years — and we like it that way. If you don’t, don’t apply.

To reshape the global financial system, we’ve raised capital from some of the world’s best investors: Sequoia Capital, Founders Fund, Brevan Howard Digital, Y Combinator, and Kaszek Ventures.

Senior Detection Engineer | SecOps

Location

London; Krakow; New York

Employment Type

Full time

Location Type

Hybrid

Department

Security

What we’re looking for

You’ll own detection engineering and help shape how ARQ detects and responds to threats. From bringing new log sources into ARQ’s SIEM to writing, testing and tuning detections, you'll be responsible for making sure our coverage works when it matters.

We’re looking for someone who combines hands‑on detection experience with an engineering mindset. You'll work directly with our CISO and a small global security team, with the autonomy to prioritise gaps and build practical solutions. Automation is central to how we work: you'll build and run AI agents that support rule development, validation, alert triage and threat hunting, with you reviewing and approving their output.

What you’ll do

Own detection engineering end to end in Datadog Cloud SIEM: identify missing log sources, prioritise onboarding and build reliable detection coverage.

Write, test and tune detection rules, reducing false positives while keeping meaningful threats visible.

Map coverage to MITRE ATT&CK and validate it by reproducing attacker activity.

Manage detections as code, using version control, CI pipelines and code review.

Build and run automation and AI agents for rule authoring, detection validation, coverage mapping, alert triage and threat hunting.

Investigate security incidents, including triage, scoping, evidence collection and clear incident write-ups.

Help develop automated response and containment capabilities.

Track and communicate detection coverage, validation results and response performance to security leadership.

What you’ll need

5+ years in security, including 3+ years writing and owning detections in production.

Hands‑on experience with a cloud SIEM and its query language, such as Datadog Cloud SIEM, Splunk, Elastic, Google SecOps.

Deep knowledge of AWS logs, particularly CloudTrail, IAM and IAM Identity Center, alongside experience with SaaS audit logs such as Google Workspace, GitHub, GitLab or Okta.

Experience managing detections as code using Terraform, Git, CI pipelines and code review.

Practical experience mapping detections to MITRE ATT&CK and testing rules by reproducing attacks with tools such as Atomic Red Team or Stratus Red Team.

Python skills for automation, log analysis and security tooling, with a record of shipping automation or AI agents that others use.

Hands‑on incident response experience, from investigating alerts to documenting findings and remediation.

The ability to work independently, prioritise effectively and own outcomes in a small team without a dedicated SOC behind you.

Strong written and verbal communication in English.

Nice to have

• Competitive salary and benefits
• Stock options, so you own part of what you build
• Discretionary performance bonus
• The latest tools and technology
• A world-class team that will challenge and grow your skills
• The opportunity to help build the best fintech app in Latin America
• Office Policy: 3-4 days a week in-office