Operations Security Engineer – Remote-First
Sign up free to see how well your resume matches this role.
What you'll do
- Act as a central point of contact for alert triage, incident identification and security event investigation across EPI environments.
- Execute incident response activities using structured frameworks such as SANS PICERL, from preparation and identification through containment, eradication, recovery and lessons learned.
- Conduct proactive, hypothesis-driven threat hunts based on attacker behaviour, emerging threats, threat intelligence and MITRE ATT&CK techniques.
- Parse, analyse and correlate logs from authentication, application, system, endpoint and cloud telemetry sources, including AWS and Azure.
- Design, tune and maintain detection rules, use cases, dashboards, custom alerts and automation workflows to identify anomalies, lateral movement and persistent threats.
- Contribute to the development and continuous improvement of SOC playbooks, runbooks, SIEM and EDR integrations.
- Document and communicate threat findings, incident outcomes and remediation recommendations clearly to technical and non-technical stakeholders.
- Collaborate with engineering, SOC, IR and IT teams to improve detection coverage, response readiness and operational resilience.
What they're looking for
- +5 years of experience in cybersecurity, with strong hands-on experience as a SOC analyst, incident responder, detection engineer or similar role.
- Fluent in English (CEFR C1 or C2); French, German, Dutch or other European languages are a plus.
- Thrive in a remote-first, multicultural and fast-paced environment.
- Strong familiarity with the full SOC lifecycle, from Tier 1 to Tier 3, including alert triage, incident response, threat hunting and threat intelligence.
- Proven experience in threat hunting, detection engineering or threat intelligence, with the ability to turn attacker behaviours into actionable detections.
- Solid understanding of SIEM and EDR technologies, log parsing, detection engineering and alert tuning.
- Hands-on experience with scripting and querying tools such as Python, PowerShell or KQL to support automation, investigations and custom alerting.
- Ability to analyse and correlate logs from diverse sources, including authentication, application, system and cloud telemetry across AWS and Azure.
- Knowledge of attacker TTPs, MITRE ATT&CK, threat exposure and attack path analysis.
- Experience creating or improving incident response playbooks, runbooks and automation workflows.
- Strong communication skills, with the ability to explain technical findings and security risks clearly to both technical and non-technical stakeholders.
- Willingness to participate in a 24/7 on-call rotation, approximately one week per month, to support incident response and operational continuity.
Nice to have
- Experience with Rapid7 and with TaHiTI.
- Familiarity with Microsoft Entra ID and its integration into detection and response workflows.
- Nice-to-have certifications such as GSEC, GCIH, BTL1/2, SC-200 or AZ-500.
- Experience in payments, banking, fintech or another highly regulated environment.
Summarised by NextRaise from the employer’s description, which follows in full below.
Full description from employer
🚀 Be part of a movement to change the way Europe pays
In today’s digital Europe, payments still feel too complicated. Random delays, confusing rules, extra apps and accounts make it harder than it should be to pay and get paid.
The European Payments Initiative is changing that with Wero, a proudly European digital wallet to make payments easier, clearer and more secure. Online, in store, at home and across borders, with your money and data protected under European laws and regulations.
Wero is live in Belgium, France, Germany and the Netherlands and launching very soon in Luxembourg and Austria. Backed by 17 major banks and the two largest European acquirers, we’re building a brand new, proudly European payment system. Why not join us?
🔎 What's in it for you
Play a key role in protecting Europe’s next-generation payment infrastructure. As an Operations Security Engineer, you will be at the heart of EPI’s Security Operations capability: triaging alerts, responding to incidents, improving detection coverage and proactively hunting for threats across cloud, identity, endpoint and application environments.
This is a high-impact opportunity to combine hands-on SOC expertise, threat hunting and detection engineering in a remote-first, pan-European company where security directly supports the resilience and trust of Wero.
🐝 About the team
You’ll join the Security Operations team within Operations Services Delivery. The team brings together highly skilled security profiles, including SOC, IAM, general security, threat hunting and penetration testing expertise.
You’ll collaborate closely with Security, Engineering, DevOps, IT and Operations teams to strengthen detection and response capabilities, improve tooling and ensure strong visibility across our environments. This role is ideal for someone who enjoys hands-on investigation, structured incident response and clear communication with both technical and non-technical stakeholders.
💥 Your impact
Act as a central point of contact for alert triage, incident identification and security event investigation across EPI environments.
Execute incident response activities using structured frameworks such as SANS PICERL, from preparation and identification through containment, eradication, recovery and lessons learned.
Conduct proactive, hypothesis-driven threat hunts based on attacker behaviour, emerging threats, threat intelligence and MITRE ATT&CK techniques.
Parse, analyse and correlate logs from authentication, application, system, endpoint and cloud telemetry sources, including AWS and Azure.
Design, tune and maintain detection rules, use cases, dashboards, custom alerts and automation workflows to identify anomalies, lateral movement and persistent threats.
Contribute to the development and continuous improvement of SOC playbooks, runbooks, SIEM and EDR integrations.
Document and communicate threat findings, incident outcomes and remediation recommendations clearly to technical and non-technical stakeholders.
Collaborate with engineering, SOC, IR and IT teams to improve detection coverage, response readiness and operational resilience.
💻 Technology stack & way of working
Primary security tools: Rapid7, Microsoft Defender, SIEM and EDR technologies
Cloud, identity & operations: AWS, Azure, Microsoft Entra ID, Okta, PagerDuty
Scripting, querying & automation: Python, PowerShell, KQL, custom alerting and auto-remediation workflows
Collaboration & delivery: Jira, Confluence, GitHub
🕵🏻♀️ To succeed, you should meet at least 70% of these requirements
+5 years of experience in cybersecurity, with strong hands-on experience as a SOC analyst, incident responder, detection engineer or similar role.
Fluent in English (CEFR C1 or C2); French, German, Dutch or other European languages are a plus.
Thrive in a remote-first, multicultural and fast-paced environment.
Strong familiarity with the full SOC lifecycle, from Tier 1 to Tier 3, including alert triage, incident response, threat hunting and threat intelligence.
Proven experience in threat hunting, detection engineering or threat intelligence, with the ability to turn attacker behaviours into actionable detections.
Solid understanding of SIEM and EDR technologies, log parsing, detection engineering and alert tuning.
Hands-on experience with scripting and querying tools such as Python, PowerShell or KQL to support automation, investigations and custom alerting.
Ability to analyse and correlate logs from diverse sources, including authentication, application, system and cloud telemetry across AWS and Azure.
Knowledge of attacker TTPs, MITRE ATT&CK, threat exposure and attack path analysis.
Experience creating or improving incident response playbooks, runbooks and automation workflows.
Strong communication skills, with the ability to explain technical findings and security risks clearly to both technical and non-technical stakeholders.
Willingness to participate in a 24/7 on-call rotation, approximately one week per month, to support incident response and operational continuity.
Nice to haves
Experience with Rapid7 and with TaHiTI.
Familiarity with Microsoft Entra ID and its integration into detection and response workflows.
Nice-to-have certifications such as GSEC, GCIH, BTL1/2, SC-200 or AZ-500.
Experience in payments, banking, fintech or another highly regulated environment.
🪜 If this looks like you, the recruitment steps are:
A first call with one of our recruiters
A technical interview with our CISO and a security expert
A final interview with our COO
Hopefully, an offer you can’t refuse
⛔ Turn back if …
You prefer a purely reactive SOC role where you only handle out-of-the-box alerts and escalations.
You don’t enjoy digging into logs, building queries, tuning detections or investigating ambiguous signals across distributed systems.
You are looking for a role with no on-call responsibilities or no operational incident response exposure.
You prefer working in isolation rather than collaborating with engineering, DevOps, IT and business stakeholders.
🎁 What we can offer
Remote-first culture with quarterly and annual all-staff in-person meetups to keep teams connected and collaborative
Possibility to work from another EU country for up to 3 months per year
Competitive compensation package, featuring salary, performance-based bonus and a thoughtfully designed, high-quality benefits programme
The opportunity to be part of a true pan-European company
Learning & development budget: €5,000 training budget per year
Otherwise apply!
🫶 Our commitment to equal employment opportunities
EPI offers the same job opportunities to all, without distinction of gender, ethnicity, religion, sexual orientation, social status, disability or age. EPI promotes the development of an inclusive work environment that mirrors the diversity of the clients our product is serving.
Company
Company facts come from this company's own listings. We only show what the postings themselves carry.