Remote Security Operations Engineer — SOC & Cloud Posture

Yellow Card; South Africa; Remote; ZAR 1,994,000 - 2,991,000; Full time

Benefits offered by this job

Stock option plan

Health coverage

Remote-first culture

Mental health support

Job summary

Yellow Card is seeking a Security Operations Engineer to own detection and response within the SOC, drive cloud posture management for AWS EKS resources, and report on security posture across the organization. This fully remote role collaborates with DevOps, Engineering, and GRC to reduce manual work through detection-as-code and SOAR automation.

You will design SIEM rules, triage alerts, automate responses, and guide vulnerability remediation in containerised environments, while maintaining

Qualifications

• Experience in security operations, cloud security, or infrastructure security engineering.
• Hands-on AWS security experience.
• Scripting in Python or Bash for automation.
• SOAR or workflow automation experience.

Responsibilities

• Design and maintain SIEM detection rules covering cloud, container, identity, and application layers.
• Triage alerts, classify and investigate signals, reduce false positives.
• Build and maintain SOAR playbooks for common alert types.
• Automate enrichment steps and maintain version control for automation.
• Oversee CSPM posture score targets and vulnerability triage.
• Co-own the vulnerability backlog with AppSec and coordinate remediation.

Skills

Fluency in English

Cross-functional collaboration

Security operations

AWS security

Kubernetes security

SIEM operations

Vulnerability management

IaC security

Incident response

Startup/scale-up experience

AI tooling familiarity

Tools

Datadog

Wiz

Orca Security

AWS Secrets Manager

Terraform

CloudFormation

Job description

Yellow Card is seeking a Security Operations Engineer to own detection and response within the SOC, drive cloud posture management for AWS EKS resources, and report on security posture across the organization. This fully remote role collaborates with DevOps, Engineering, and GRC to reduce manual work through detection-as-code and SOAR automation.

You will design SIEM rules, triage alerts, automate responses, and guide vulnerability remediation in containerised environments, while maintaining