Security Engineer III - Detection & Response

About the role

An Introduction to Primer

Primer is the unified infrastructure for global payments. We give finance and payments teams the visibility and control to reduce complexity, improve performance, and capture more revenue - all from a single platform.

Backed by Sofina, Peak XV Partners, ICONIQ, Tencent, Accel, and Balderton, we're building the payments layer the world's best companies rely on.

Watch our showcase > https://primer.io/the-primer-showcase

Read up on our $100m Series C https://www.primer.io/blog/series-c

Learn more about our culture > https://primer.io/careers

What team will you be joining?

Primer processes payments for some of the world's best companies, which makes us an attractive target and means getting detection and response right really matters. We're looking for a Security Engineer to join our Detection & Response function and own a meaningful slice of how we detect, investigate and respond to threats across our cloud infrastructure and SaaS estate.

You'll write and tune the detections in our SIEM, build the automation that speeds up how we react, and be a first responder when something looks wrong. You'll have real ownership of the areas you work on, and the freedom to shape how we detect and respond to threats across them.

You'll also work closely with our Application Security/Product Security engineers: what we learn from detections and incidents shapes how we build, and what they know about our products shapes what we look for.

What you'll be doing:

Detection

- Build, tune and maintain detections in our SIEM (Elastic), and identify opportunities to onboard new log sources (e.g. AWS, Google Workspace, Kubernetes) and build new detections on top of them.

- Find what our current detections miss, and keep the rule set lean by removing what no longer adds value.

- Use Python and Terraform to build and maintain the infrastructure behind your detections and tooling.

Response

- Own investigation: triage, investigate, escalate and resolve security incidents, and write up findings clearly enough to stand on their own

- Lead routine incidents end to end, and take a clear role in larger ones, whether that's driving the investigation or keeping stakeholders informed

- Build runbooks and automations (Python, Tines or similar) to cut manual work out of triage and response

- Join our on-call rotation for incident response and monitoring

Across both

- Make and document risk decisions in your area, and know when to pull in others.

- Keep the controls you own audit-ready and contribute evidence for audits (e.g. SOC 2, PCI DSS).

- Use AI tools to work faster across detection and response, from drafting rules and queries to summarising investigations, while maintaining a healthy level of scepticism.

What we're looking for: