Security Engineer - Incident Response

About CloudWalk:

We are not just another fintech unicorn. We are a pack of dreamers, builders, and tech enthusiasts shaping the future of payments. With millions of customers and a hunger for innovation, we are expanding our neural network — literally and metaphorically.

About the Role:

Security here moves at the same speed as engineering. This is not a traditional SOC role. You will not spend your day staring at dashboards and closing noisy alerts. You will build the systems that tell us when something is wrong, investigate when it is, and make sure we come back stronger after every incident. You will own and evolve our SIEM, connect signals across cloud, endpoints, identities and applications, and help turn offensive security knowledge into real detection and response capabilities.

What You'll Do

Build our security nervous system. Own and improve the SIEM, telemetry pipelines, enrichment and correlation across CloudWalk.
Create detections that matter. Turn attacker behavior, real incidents and Red Team findings into useful signals instead of alert spam.
Respond when things get weird. Investigate incidents from first signal to containment, recovery and lessons learned.
Hunt before alerts fire. Search proactively for suspicious behavior and visibility gaps.
Automate aggressively. Build tools and workflows for triage, enrichment, evidence collection and containment.
Work with attackers. The friendly kind. Partner closely with Offensive Security to turn attack paths into detections and controls.
Use AI as leverage. Build agents and automations for investigation, log analysis, alert enrichment and response.

What You Need to Succeed

Strong understanding of detection engineering, incident response and attacker behavior.
Experience investigating security events across multiple sources of telemetry.
Experience with SIEMs, logging platforms or large-scale security data.
Good understanding of cloud environments, IAM, Kubernetes and modern infrastructure.
Ability to investigate authentication, endpoint, network, application and cloud activity.
You code. Python, Go, Typescript or something similar. We want engineers, not dashboard operators.
Ability to distinguish a real attack from noisy telemetry without losing your sanity.
Clear communication during incidents, especially when information is incomplete and the stakes are high.

Nice to Have

Experience with BigQuery, Chronicle, Splunk, Elastic/OpenSearch, Datadog, Sentinel or similar platforms.
Detection-as-code, Sigma, YARA, osquery or Suricata.
EDR, threat hunting or digital forensics experience.
Experience automating incident response or building internal security tooling.
Offensive security knowledge, including C2, persistence, privilege escalation and lateral movement.
Experience with payment systems or PCI DSS.
Experience applying LLMs or AI agents to security operations.
Security research, open source contributions or CTF experience.

The Future We See:

At CloudWalk, we envision a future where AI empowers every field to reach new heights:
• People teams leveraging AI to transform talent acquisition and employee development.
• Marketing professionals creating data-driven, AI-powered campaign strategies.
• Customer Success teams enhancing client experiences with intelligent solutions.
• Risk analysts combining human expertise with AI to navigate complexities.
• Designers collaborating with AI to push creative boundaries.

Join us at CloudWalk, where we're not just engineering solutions; we're building a smarter, AI-driven future for payments—together.

By applying for this position, your data will be processed as per CloudWalk's Privacy Policy.