Security Engineer – Detection & Security Operations

About the role

You will lead the creation of Reap's detection capability, turning known threat actor tactics into robust, automated controls. Partnering with engineering, risk and operations, you will ensure the company can move value safely 24/7 across a global payment platform.

Key responsibilities

• Own the SIEM platform from evaluation to production, selecting the solution and driving ingestion from CrowdStrike, AWS CloudTrail, Okta, M365 and SaaS applications.
• Write and maintain detection rule libraries targeting known TTPs such as Lazarus Group C2 beaconing, credential harvesting, lateral movement and AI data exfiltration.
• Define alert triage and escalation processes, set SLAs, reduce false positives and handoff confirmed incidents to the Crypto/IR Security Engineer.
• Operationalise threat intelligence feeds, extract IOCs/TTPs and translate them into detection rules on a regular cadence.
• Build security metrics dashboards and automated reports for the CISO board pack (mean detection time, mean response time, alert volume, coverage gaps).

Required profile

• Proven experience building detection rules from scratch and deploying SIEM platforms such as Microsoft Sentinel, Splunk or Elastic.
• Hands‑on integration of log sources including AWS CloudTrail, Okta, CrowdStrike Falcon and Microsoft 365 audit logs.
• Strong understanding of MITRE ATT&CK and ability to convert threat‑actor profiles into actionable detection logic.
• Experience in alert triage, investigation and refining detection efficacy.
• Python programming for security automation, log parsing and response workflows.

Required skills

• SIEM platforms: Microsoft Sentinel, Splunk, Elastic
• KQL or SPL query languages
• AWS CloudTrail, Okta, CrowdStrike Falcon, Microsoft 365 audit logs
• MITRE ATT&CK framework
• Python scripting
• SOAR tools: Sentinel Playbooks, Splunk SOAR (optional)

What we offer

• Remote‑first work model with APAC‑friendly hours
• Inclusive and vibrant company culture
• Annual leave plus public holidays
• Health insurance budget
• Home office equipment budget and corporate Reap Card
• Opportunity to build detection capability from the ground up alongside CISO and crypto security engineers