Are you the kind of person who doesn’t just respond to alerts, but improves the systems that generate them? Do you enjoy turning threat intelligence into detection logic, and are you comfortable taking ownership during a live incident? If so, this is the role for you.
Responsibilities and Tasks
Design, develop, and continuously improve detection use cases, alerting logic, and correlation rules across SIEM/SOAR/EDR/DLP platforms.
Act as a senior technical responder for security incidents, serving as Incident Commander for medium-severity incidents and as a key technical escalation point, supporting the Lead, in high-severity ones.
Contribute to post-incident reviews and drive the resulting remediation actions to completion.
Mentor and support junior and mid-level Blue Team engineers through code reviews, knowledge sharing, and day-to-day guidance.
Partner with Red Team and Threat Intelligence in purple team exercises, translating findings into improved detection coverage against emerging TTPs.
Contribute to the detection roadmap and take ownership of specific detection domains or initiatives.
Track and report on detection efficacy metrics (MTTD, MTTR, false-positive rates, MITRE ATT&CK coverage) for your areas of ownership.
Collaborate with Engineering, SRE, and IT teams on security tooling, detection integration, and remediation prioritization.
Build and maintain automation for detection, triage, and response (SOAR playbooks, scripting, IaC for security tooling).
Support audits, risk reviews, and compliance efforts (GDPR, PCI DSS, SOC II) by providing technical evidence and detection/response expertise.
Participate in the on-call rotation and after-hours coverage model for the D&R function.
Write and maintain security operations playbooks, runbooks, and documentation, ensuring knowledge transfer across the team.
Contribute to the evaluation of detection and response tools and technologies.
Qualifications
Technical skills
Bachelor’s degree in a related field (or equivalent practical experience) and 5+ years of experience in IT/cybersecurity, including detection engineering, SOC, or incident response roles.
Strong working knowledge of SIEM, SOAR, EDR/AV, and DLP platforms, including hands-on use case development and log/telemetry interpretation.
Experience handling and leading the technical response to complex security incidents, coordinating with multiple teams.
Solid command of MITRE ATT&CK and current threat actor TTPs; experience translating threat intelligence into detection logic.
Working knowledge of GDPR, PCI DSS, SOC II, and how they inform detection/response requirements in a regulated environment.
Familiarity with BYOD and DLP programs.
Good understanding of cloud security (AWS/Azure/GCP), containers, and infrastructure as code.
Proficiency in scripting/automation (Python, Bash, Go, Ruby) and CI/CD pipelines for security tooling.
Solid grasp of OWASP Top 10, common fraud patterns, malware behavior, and other threat categories relevant to a payments/fintech environment.
Understanding of network and platform security, WAF, and enterprise detection/response practices.
Comfortable operating across Windows, macOS, and Linux environments.
Ability to own projects end to end: scoping, prioritizing, delivering, and reporting on outcomes.
Soft skills
Experience mentoring or informally guiding other engineers (formal people management is not required).
Ability to stay calm and methodical during a live security incident, and to contribute to structured post-incident learning.
Strong communication skills, able to explain technical detail clearly to both technical and non-technical stakeholders.
Effective collaboration with Security, Engineering, SRE, and IT teams.
Autonomy and good judgment: you know when to decide on your own and when to escalate.
Availability to travel occasionally.
Strong written and spoken English; additional languages are a plus.
What We Offer
Competitive compensation
Employee Stock Purchase Plan (ESPP)
Competitive time off
Work with brilliant people globally Learn more about their journeys by checking out #InsideFlywire on social media
Wellbeing Programs (Mental Health, Wellness, Yoga/Pilates/HIIT Classes) with Global FlyMates
Be a meaningful part in our success - every FlyMate makes an impact
Great Talent & Development Programs (Managers Taking Flight – for new or aspiring managers, OneFlywire Career Mobility)
Submit today and get started!
We are excited to get to know you! Throughout our process you can expect to meet with different FlyMates including the Hiring Manager, Peers on the team, the VP of the department, and a skills assessment. Your Talent Acquisition Partner will walk you through the steps and be your “go-to” person for any questions.
Flywire is an equal opportunity employer and follows a policy of administering all employment decisions and personnel actions without regard to race, color, religion, sex, pregnancy, gender identity, national origin, age, ancestry, physical or mental disability, sexual orientation, genetic disposition or carrier status, veteran status, or any other category protected under applicable national, federal, state or local law.
