- Company Name
- Affirm
- Job Title
- Staff Security Operations Engineer, (Detection & Response Lead)
- Job Description
-
**Job Title**
Staff Security Operations Engineer (Detection & Response Lead)
**Role Summary**
Lead the Security Incident Response (SIR) and Detection & Response (D&R) program across Europe, shaping strategy for global expansion. Serve as technical commander, architect logging/detection pipelines, and the escalation point for complex incidents in a cloud‑native environment.
**Expectations**
- Demonstrate senior leadership and deep technical expertise in D&R programs aligned with GDPR, DORA, ISO 27001, UK NCSC CAF.
- Own incident command, containment, remediation, and post‑mortem reviews.
- Collaborate with Legal, Privacy, Engineering, and Infrastructure to ensure compliance and scalable security operations.
- Mentor team members and represent the organization externally in security communities.
**Key Responsibilities**
- Design and execute the Europe‑wide D&R strategy, expanding the program with scalable playbooks, detection pipelines, and automation.
- Act as Incident Commander during large‑scale events, guiding containment, remediation, and post‑incident analysis.
- Serve as the technical escalation point for investigations and incidents, handling hands‑on resolution.
- Build and refine logging, telemetry ingestion, and normalization workflows across AWS/EKS environments.
- Develop advanced detections using MITRE ATT&CK, contribute to Cyber Threat Intelligence (CTI) for proactive mitigation.
- Deliver briefings and updates to executive and technical audiences.
- Partner with cross‑functional teams on security engineering projects, resilience initiatives, and data‑strategy compliance.
- Mentor and train staff, fostering a collaborative culture.
- Engage with the broader security community through talks and publications.
**Required Skills**
- 7+ years establishing and scaling D&R programs for international, cloud‑native organizations.
- Proven incident command, containment, and remediation experience in AWS/EKS.
- Hands‑on expertise with SIEM, EDR, and MDR platforms (e.g., Splunk, Elastic, SentinelOne, CrowdStrike, Red Canary, Expel).
- Strong knowledge of data ingestion, normalisation, and telemetry pipelines.
- Familiarity with MITRE ATT&CK and advanced detection development.
- Excellent communication and leadership skills; ability to tailor messaging for technical, operational, and executive stakeholders.
- Deep understanding of GDPR, DORA, ISO 27001, UK NCSC CAF compliance.
**Required Education & Certifications**
- Bachelor’s degree in Computer Science, Information Security, or related field.
- Professional certifications such as CISSP, GCIP, or equivalent; AWS Certified Security – Specialty preferred.