Senior Detection & Response Engineer - FinTech

Kikoff; San Francisco (CA); On-site; USD 338,000 - 387,000; Full time

Job summary

Kikoff in San Francisco is seeking a Senior Security Engineer to own the Detection & Response pillar for our fintech environment. You will shape the detection strategy across AWS, endpoints, identity, SaaS, and CI/CD, and lead incident response lifecycle from triage to remediation, working with on-call playbooks and runbooks.

You will write detections as code, reduce false positives, and build scalable telemetry pipelines.

Qualifications

• 6+ years in security with detection engineering and incident response in cloud-native environments (AWS preferred).
• You've written detections yourself: SIEM rules or detection-as-code pipelines, and you've owned the false positive rate that came with them.
• Hands-on incident response experience leading real incidents, not just participation.
• Strong command of cloud-native logging and detection surfaces.
• Experience with EDR at fleet scale and identity-based detection.
• Fluency in automation languages (Python, Go, Ruby or similar).
• Comfortable in a fintech regulated environment.

Responsibilities

• Own the incident response lifecycle: triage, containment, forensics, postmortem, remediation tracking.
• Lead technical investigations, including insider risk and unauthorized access cases.
• Design and maintain detection coverage across AWS, endpoints, identity, SaaS and CI/CD; write detections as code.
• Build audit logging and telemetry pipelines for scalable visibility, including data access monitoring.
• Develop runbooks, escalation paths, and tabletop exercises to improve incident response.

Skills

Security engineering

Incident response

Cloud-native logging

EDR

Automation with Python/Go/Ruby

Fintech/regulatory experience

Tools

SentinelOne EDR

Okta

AWS CloudTrail

GuardDuty

SIEM

Detection-as-code

Job description

Kikoff in San Francisco is seeking a Senior Security Engineer to own the Detection & Response pillar for our fintech environment. You will shape the detection strategy across AWS, endpoints, identity, SaaS, and CI/CD, and lead incident response lifecycle from triage to remediation, working with on-call playbooks and runbooks.

You will write detections as code, reduce false positives, and build scalable telemetry pipelines.