Job description

Most security teams react, tuning SIEM rules after the alert fires and writing playbooks after the incident closes, and this Senior Security Operations Engineer role exists to make threats irrelevant before they become incidents. You help build an autonomous security operations platform at Deriv that hunts proactively, responds automatically, and learns continuously, protecting a distributed system that processes transactions around the clock. Detection logic gets built to fire early, extending SIEM custom rules, AI-powered anomaly baselines, and automated alert enrichment that cuts noise and surfaces what actually matters. Threat hunts run on hypotheses rather than hunches, using behavioural analytics, log forensics, and threat intelligence to surface adversarial activity hiding below the alert threshold. You automate the response too, replacing manual triage with intelligent playbooks that contain threats in minutes, turning a senior analyst's six-step process into a runbook that runs unattended overnight. Real-time dashboards track detection coverage, active incidents, misconfiguration trends, and policy compliance for the team and for leadership. Security assessments run across cloud, endpoint, network, and application layers, mapping gaps against MITRE ATT&CK, CIS, and NIST benchmarks before attackers find them first. Zero Trust gets enforced in practice, closing IAM gaps, applying least privilege across cloud workloads, and strengthening MFA and conditional access, while container security and CI/CD guardrails keep vulnerabilities out of production.