Security Engineer - Incident Response

CloudWalk, Inc. is a fintech company building AI-driven solutions for the future of payments. The Security Engineer will build and evolve the SIEM, develop meaningful detections, investigate and respond to incidents, proactively hunt for threats, and automate security operations. The role also partners with Offensive Security and applies AI to investigation, log analysis, alert enrichment, and response.

Responsibilities:

• Build our security nervous system. Own and improve the SIEM, telemetry pipelines, enrichment and correlation across CloudWalk
• Create detections that matter. Turn attacker behavior, real incidents and Red Team findings into useful signals instead of alert spam
• Respond when things get weird. Investigate incidents from first signal to containment, recovery and lessons learned
• Hunt before alerts fire. Search proactively for suspicious behavior and visibility gaps
• Automate aggressively. Build tools and workflows for triage, enrichment, evidence collection and containment
• Work with attackers. The friendly kind. Partner closely with Offensive Security to turn attack paths into detections and controls
• Use AI as leverage. Build agents and automations for investigation, log analysis, alert enrichment and response

Requirements:

• Strong understanding of detection engineering, incident response and attacker behavior
• Experience investigating security events across multiple sources of telemetry
• Experience with SIEMs, logging platforms or large-scale security data
• Good understanding of cloud environments, IAM, Kubernetes and modern infrastructure
• Ability to investigate authentication, endpoint, network, application and cloud activity
• You code. Python, Go, Typescript or something similar. We want engineers, not dashboard operators
• Ability to distinguish a real attack from noisy telemetry without losing your sanity
• Clear communication during incidents, especially when information is incomplete and the stakes are high
• Experience with BigQuery, Chronicle, Splunk, Elastic/OpenSearch, Datadog, Sentinel or similar platforms
• Detection-as-code, Sigma, YARA, osquery or Suricata
• EDR, threat hunting or digital forensics experience
• Experience automating incident response or building internal security tooling
• Offensive security knowledge, including C2, persistence, privilege escalation and lateral movement
• Experience with payment systems or PCI DSS
• Experience applying LLMs or AI agents to security operations
• Security research, open source contributions or CTF experience