Senior Security Engineer, Detection & Response

Job description

**This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Senior Security Engineer, Detection & Response based in Brazil .** As a Senior Security Engineer, Detection & Response, you will play a critical role in protecting cloud infrastructure, applications, and sensitive data by strengthening security monitoring and incident response capabilities. You will design, operate, and continuously improve detection systems, investigate suspicious activity, and lead security incidents from initial discovery through root-cause resolution. The role combines hands-on security engineering, vulnerability management, proactive threat hunting, and cloud-native security expertise. You will collaborate with infrastructure, platform, and engineering teams to improve security controls, strengthen auditability, and ensure effective remediation. You will also leverage AI-powered tools and automation to streamline investigations and scale security operations. This opportunity is ideal for an experienced, action-oriented security professional who enjoys solving complex technical challenges in a fast-paced, cloud-first environment. ### Accountabilities - Security monitoring and detection engineering: Build, operate, and mature SIEM/XDR capabilities, including log ingestion pipelines, detection rules, alert tuning, monitoring, and investigation workflows. Improve detection accuracy while reducing false positives and unnecessary alert noise. - Audit logging and attribution: Extend audit coverage across cloud infrastructure and applications, including Kubernetes audit logs, database activity, single sign-on (SSO), and access-path telemetry. Ensure sensitive-data access can be attributed to a specific person or workload and that logs are retained in line with compliance requirements. - Incident response and root-cause analysis: Investigate and respond to security incidents across cloud environments and applications. Identify root causes, coordinate remediation, and ensure corrective measures prevent recurring issues. - Threat hunting: Conduct proactive threat hunts across cloud and identity environments, analyzing telemetry and suspicious behavior to uncover potential threats before they escalate. Develop repeatable, AI-assisted hunting workflows to improve efficiency and coverage. - Vulnerability management: Own the vulnerability-management lifecycle across infrastructure, platforms, and applications, including internal scanning, dependency analysis, assessment of external findings, validation of true positives, remediation coordination, and verification of fixes. - External security findings: Triage and investigate external reports, including bug bounty submissions, distinguish actionable vulnerabilities from false positives, and coordinate timely resolution with the relevant engineering teams. - Security architecture and threat modeling: Participate in threat modeling and security design reviews, evaluating new systems for detection, logging, monitoring, and incident-response requirements. - Cloud and container security: Apply strong AWS, Linux, and Kubernetes security expertise to assess risks, strengthen configurations, and advise system owners on appropriate remediation measures. - Compliance and audit readiness: Implement and support security controls aligned with PCI DSS, SOC 2, and other relevant compliance requirements. Maintain effective logging, monitoring, and audit evidence as part of day-to-day security operations. - Automation and AI-assisted engineering: Develop automation and AI-powered workflows for alert triage, investigation, threat hunting, and security operations. Evaluate emerging tools pragmatically to improve productivity and expand the team's capabilities. - On-call responsibilities: Participate in the detection and response on-call rotation and help maintain the reliability and effectiveness of the security services under your ownership. - Cross-functional collaboration: Work closely with security, infrastructure, network, platform, and application engineering teams to validate controls, resolve security weaknesses, and embed security practices into the development lifecycle. ## Requirements - Professional experience: At least 6 years of experience in security, software, or infrastructure engineering, including hands-on responsibility for securing cloud-based production systems and addressing real-world security incidents. - SIEM and detection engineering: Practical experience with SIEM platforms such as Wazuh, Splunk, or ELK, including detection-rule development, security monitoring, alert tuning, and incident investigation. - Incident investigation: Ability to investigate suspicious activity directly using logs, cloud-native tools, system-level telemetry, and application or database data, translating technical findings into actionable security improvements. - Vulnerability management: Strong hands-on experience with security scanning, vulnerability triage, validation of scanner and bug bounty findings, remediation coordination, and verification of completed fixes. - Cloud infrastructure: Strong knowledge of AWS, Linux, and Kubernetes, including cloud security architecture, identity and access management, network segmentation, container security, and operational best practices. - Security fundamentals: Solid understanding of common security vulnerabilities, attack techniques, and mitigation strategies, informed by established guidance such as OWASP and SANS. - Security architecture: Experience evaluating the security implications of new systems and contributing to design reviews, threat modeling, and logging or monitoring strategy. - Compliance knowledge: Working knowledge of security and compliance frameworks such as PCI DSS and SOC 2, particularly their requirements for logging, monitoring, evidence collection, and audit readiness. - AI-forward engineering: Demonstrated practical use of AI-assisted engineering tools, such as Claude Code, Codex, Cursor, or custom large language model integrations, with a clear understanding of their strengths, limitations, and appropriate applications. - Preferred technical experience: Familiarity with telemetry pipelines, log-based detection, security analytics, internal penetration testing, adversarial exercises, and translating attack findings into improved detections and remediation plans. - Security tooling: Experience operating container and dependency security tools such as Snyk, Trivy, or Grype and managing the vulnerabilities they identify. - Industry exposure: Experience in fintech, payments, or another regulated industry is an advantage, particularly where security controls must support demanding operational and regulatory requirements. - Education: A bachelor's degree in Computer Science, Computer Engineering, or a relevant technical field is expected. - Analytical mindset: Strong investigative and problem-solving skills, with the ability to turn complex technical telemetry into clear findings, effective detections, and lasting solutions. - Ownership and accountability: A proactive, hands-on approach, with a commitment to assigning clear ownership to findings, following issues through to resolution, and maintaining high standards of technical quality. - Communication and collaboration: Ability to challenge assumptions constructively, communicate risks clearly, work effectively across teams, and balance security requirements with practical business needs. - Adaptability and execution: Comfort working in a fast-moving environment, making informed decisions, embracing new approaches, and delivering measurable outcomes without unnecessary delays. ## Benefits - Competitive compensation: Gross monthly salary ranging from $5,000 to $9,500 USD, depending on experience, expertise, and the level of contribution expected. - Remote work: A remote opportunity with a full-time employment arrangement, offering flexibility in where you work, subject to the role's location and employment requirements. - High-impact security work: The opportunity to strengthen detection and response capabilities across cloud infrastructure, applications, and sensitive data in a technology-driven environment. - AI-assisted engineering: Opportunities to use and develop AI-powered workflows that improve security investigations, threat hunting, alert triage, and operational efficiency. - Technical ownership: End-to-end responsibility for meaningful security initiatives, from identifying vulnerabilities and investigating incidents to implementing lasting fixes. - Modern technology stack: Exposure to AWS, Kubernetes, Linux, Go, TypeScript, Python, MySQL, PostgreSQL, Elasticsearch, GitLab, and automated testing practices. - Engineering-focused culture: An emphasis on practical problem-solving, open-source technologies, experimentation, continuous improvement, and building solutions where appropriate. - Collaborative environment: The opportunity to work alongside experienced professionals across security, infrastructure, networking, and software engineering. - Professional development: Opportunities to deepen expertise in cloud security, detection engineering, incident response, vulnerability management, and emerging AI technologies. - Meaningful responsibility: A chance to influence security standards, improve operational resilience, and help protect critical systems in a fast-paced business environment.