Security Operations Engineer

🕒 July 19

🇺🇸 United States – Remote

⏰ Full Time

🟡 Mid-level

🟠 Senior

🛡️ Security Operations

👻 Ghost score 69%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Yellow Card App

WebsiteLinkedInAll Job Openings

51 - 200 employees

💳 Fintech

💸 Finance

💰 $40M Series B on 2022-09

Fintech • Payments • Finance

Yellow Card App is a pan-African fintech company operating in 20 countries. It is the largest and first licensed Stablecoin on-ramp/off-ramp on the African continent, offering secure and cost-effective solutions for businesses to buy and sell Stablecoins like USDT, USDC, and PYUSD using local currency. The platform facilitates borderless transactions and business payments through their Payments API and Widget, targeting businesses of all sizes. Yellow Card ensures secure and seamless financial operations across Africa with an emphasis on digital assets and mobile money integration.

📋 Description

• Own the full lifecycle of security detection and response inside the SOC, from signal design through automated containment • Design and maintain SIEM detection rules across cloud, container, identity, and application layers • Map detection coverage against MITRE ATT&CK and identify gaps across AWS and EKS attack surfaces • Integrate threat intelligence feeds and maintain a risk-prioritised detection backlog • Perform daily SIEM alert triage, investigate and resolve security signals, and reduce false positives through structured tuning • Maintain triage runbooks for production detection rules • Build and maintain SOAR playbooks for IAM anomalies, misconfiguration alerts, exposed secrets, and container runtime events • Automate alert enrichment and maintain version control for playbooks • Measure and report automation coverage • Own vulnerability triage for cloud and container environments using CVSS, asset criticality, and exploitability context • Manage EKS vulnerability coverage, including base images, workload scans, pod security standards, and node group patching • Coordinate remediation with engineering teams, track progress, and escalate SLA breaches • Maintain MTTR and SLA compliance data by severity • Oversee CSPM posture targets and triage Critical findings within SLA windows • Review and approve IAM policy changes and conduct scheduled IAM hygiene reviews • Govern EKS workload identity and support secrets rotation • Review and approve cloud network security changes, including security groups, network ACLs, and routing • Own container image security and investigate CSPM misconfiguration alerts • Maintain configuration baselines and flag drift • Collect and maintain SOC and cloud security Key Risk Indicator data • Execute weekly, monthly, and quarterly infrastructure security control reviews • Produce structured findings reports and escalate control failures • Provide posture metrics and trends for required reporting cycles • Support audits and due diligence by providing evidence artefacts • Co-own the infrastructure vulnerability backlog with Application Security • Serve as infrastructure and identity SME for AppSec assessments and architecture reviews • Own infrastructure containment during incidents spanning application and infrastructure layers • Review infrastructure, identity, and network security for third-party integrations • Collaborate with Security GRC on SOC 2, ISO 27001, and GDPR control evidence and compliance mapping

🎯 Requirements

• Fluency in English, both written and verbal • Ability to collaborate with cross-functional teams and across different time zones • 3 to 5 years of experience in security operations, cloud security, or infrastructure security engineering • Hands-on AWS security experience: IAM policy design, virtual network architecture, cloud-native security services, CloudTrail, GuardDuty • Kubernetes and EKS security experience: pod security standards, network policy enforcement, workload identity, image scanning • SIEM operations: alert triage, detection rule authoring, log analysis and correlation • Vulnerability management: CSPM tooling, risk-based prioritisation, CVSS scoring, SLA framework operation • Ability to read and review Terraform or CloudFormation for misconfigurations • Incident response: investigation, containment, and post-incident reporting • Experience in a regulated environment such as FinTech, payments, banking, or crypto • Ability to author and tune detection rules without relying on vendor-supplied defaults • Structured written communication for triage reports, post-incident write-ups, and stakeholder metrics • Ability to coordinate remediation across engineering teams without direct authority • Comfort operating in a lean team where domain boundaries are broader than in large enterprise security functions • AWS Security Specialty certification is highly valued • Experience with CSPM and SIEM platforms: Datadog, Wiz, Orca Security • Experience with AWS Secrets Manager • Familiarity with SOC 2, ISO 27001, GDPR, and DORA • Scripting ability in Python or Bash for detection-as-code and operational automation • Experience with SOAR or workflow automation platforms • Understanding of cryptocurrency or blockchain security considerations • Experience in a startup or scale-up environment • AI tooling familiarity and interest in applying AI to operational workflows

🏖️ Benefits

• Competitive compensation • Meaningful health coverage • Stock option plan for all full-time employees • Access to learning and development resources • Professional growth support and autonomy • Fully remote work environment • Mental Health Support Services • Ownership of the SOC and cloud security posture function from day one • Broad domain exposure across detection engineering, cloud security, container security, incident response, and compliance • Collaborative team culture with mature AppSec function and strong leadership support