{"id":2914497,"url":"https://alion.io/job/deriv-senior-security-operations-engineer-security-operations-ai-driven-defense","title":"Senior Security Operations Engineer (Security Operations & AI-Driven Defense)","company":{"id":1778315,"name":"Deriv","domain":"deriv.com","url":"https://alion.io/company/deriv","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Zoho Recruit","truth_index":{"grade":"C","score":58,"open_postings":17,"ghost_share":0.706,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Dubai, United Arab Emirates"],"countries":["AE"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":38000,"max_usd":88000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Anomaly Detection","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Terraform","optional":false},{"name":"Zero Trust","optional":false},{"name":"Google Workspace","optional":true},{"name":"Okta","optional":true}],"status":"live","first_seen_at":"2026-08-26T00:00:00Z","employer_posted_date":"2026-08-26","last_verified_at":"2026-10-27T00:39:44Z","board_verified":true,"closed_at":null,"days_open":62,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":61},"description":"We’re not hiring a security engineer to keep up with threats. We’re hiring someone to make threats irrelevant before they become incidents.\nMost security teams react. They tune SIEM rules after the alert fires. They write playbooks after the incident closes. They patch after the scan flags. At Deriv, we’re building an autonomous security operations platform that hunts proactively, responds automatically, and learns continuously. Real money, real regulations, real consequences - and a security function built to match.\nWhy This Matters\nDeriv’s mission is Trading for Anyone, Anywhere, Anytime. Millions of traders across the globe, around the clock, across regulatory environments. At this scale, a misconfigured WAF rule or undetected lateral movement isn’t a technical inconvenience - it’s a trader’s funds at risk and a regulator on the phone.\nOur Security Operations team isn’t defending a perimeter. We’re protecting a living, distributed system that processes transactions 24/7. When the threat surface never sleeps, your detection and response capabilities can’t either - which is exactly why we’re embedding AI and automation at every layer of the security stack.\nWhy Deriv\nWe’re already in production, not planning:\nAutomated security review on every pull request - continuous code-level scanning, not quarterly audits\nDozens of fraud detection models running continuously in production, protecting real transactions at scale\nAI-driven anomaly detection across identity, endpoint, and network telemetry\n400+ internal users on our workflow orchestration platform - including security response workflows\nScope of Work\nYou’ll own outcomes across Security Operations with focus on four areas:\nThreat Detection & Response - SIEM optimisation, EDR/XDR tuning, incident investigation, threat hunting\nAI-Driven Defence - Anomaly detection models, UEBA, automated triage, phishing detection pipelines\nSecurity Hardening - Cloud security posture (AWS, GCP, Azure), WAF/CDN configuration, SSO and IAM policy enforcement\nCross-functional Security - Integrating controls into engineering workflows, CI/CD pipelines, and DevOps processes\nWhat You’ll Do\nDetect and Hunt\n\nBuild detection logic that fires early: Extend SIEM custom rules, AI-powered anomaly baselines, and automated alert enrichment that reduce noise and surface what matters.\nRun threat hunts with hypotheses, not hunches: Use behavioural analytics, log forensics, and threat intelligence to surface adversarial activity hiding below the alert threshold.\nTune signal, not noise: Optimise EDR/XDR configurations to cut false positives and make attack visibility actionable - not overwhelming.\nAutomate the Response\n\nReplace manual triage with intelligent playbooks: Build incident response automation that contains threats in minutes, not hours.\nEncode institutional knowledge into systems: When a senior analyst’s six-step response becomes a runbook, you turn it into a workflow that runs at 3am without them.\nShip real-time visibility: Build automated dashboards tracking detection coverage, active incidents, misconfiguration trends, and policy compliance - for the team and for leadership.\nHarden the Perimeter\n\nReview configurations before attackers do: Run security assessments across cloud, endpoint, network, and application layers - mapping gaps against MITRE ATT&CK, CIS, and NIST benchmarks.\nEnforce Zero Trust in practice, not just policy: Work with IT and Engineering to close IAM gaps, apply least privilege across cloud workloads, and strengthen MFA and conditional access controls.\nProtect the build pipeline: Ensure container security, CI/CD guardrails, and automated compliance scanning prevent vulnerabilities from reaching production.\nWho You Are\n\n8+ years in security operations - incident response, threat detection, or blue team work. You know what attacks actually look like in logs, not just textbooks.\nYour SIEM is a weapon, not a logging system: You write custom detection rules, tune thresholds, and build correlation logic. You’ve reduced false positives by an order of magnitude at least once.\nYou automate before you escalate: Python, Bash, or Terraform is how you respond to repetitive problems. When a manual step happens twice, you script it the third time.\nYou understand AI’s role in security - and its limits: You’ve worked with ML-based anomaly detection, UEBA, or AI-driven phishing models. You know where they catch things humans miss, and where they need guardrails.\nYou secure cloud environments at scale: AWS, GCP, or Azure - you’ve reviewed posture, implemented compliance scanning, and closed misconfigurations before they became incidents.\nYou communicate risk, not just findings: You translate technical exposure into decisions that reach engineering leads and executives without losing accuracy.\nCertifications are a signal, not a requirement: CISSP, GSEC, AWS Security Specialty, or equivalent. What matters is what you’ve actually built and stopped.\nTech Stack\n\nLanguages & Automation: Python, Bash, Terraform\nSIEM / Detection: Custom rule logic, AI-driven anomaly baselines, automated alert triage\nEndpoint: EDR/XDR platforms, UEBA, behavioural analytics\nIdentity & Access: Okta, Google Workspace, Azure AD - SSO, MFA, conditional access\nCloud: AWS, GCP, Azure - security posture management, automated compliance scanning\nPerimeter: WAF/CDN hardening, API abuse prevention, bot mitigation\nThe Honest Reality\n\nThis is demanding work. You’ll build systems that catch threats your colleagues haven’t seen yet - and raise findings that aren’t always welcome. You’ll tune detections where a 1% miss rate means real exposure in a regulated environment. You’ll balance moving fast in engineering culture with the security controls that make speed sustainable.\nBut you’ll build security operations that actually catch things - continuously, automatically, at scale. Automated security review already ships on every PR. Fraud models run in production. The investment in AI-driven defence is real, not a slide deck.\nIf you want to maintain existing tools and respond to tickets, this isn’t it. If you want to build security systems that render entire threat categories obsolete, it might be.","description_format":"text","description_chars":6195,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Online Brokerage & Trading Platforms","Forex & CFD Brokers"],"lifecycle":[{"event":"open","at":"2026-10-20T10:25:49Z"}],"visa":[],"liveness":{"score":13,"band":"cold","label":"Long shot","p_open":1,"p_active":0.355,"p_room":0.36,"age_days":61,"expected_fill_days":36,"reasons":["conf:0","stale_co","win:tail","crowd:"],"computed_at":"2026-10-26T05:57:25Z"},"pay":null,"html_url":"https://alion.io/job/deriv-senior-security-operations-engineer-security-operations-ai-driven-defense","json_url":"https://alion.io/job/deriv-senior-security-operations-engineer-security-operations-ai-driven-defense.json","meta":{"generated_at":"2026-10-27T02:17:56Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":1468,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1778315},"rest":"https://alion.io/mcp/rest/get_company?id=1778315"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fderiv-senior-security-operations-engineer-security-operations-ai-driven-defense"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fderiv-senior-security-operations-engineer-security-operations-ai-driven-defense"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fderiv-senior-security-operations-engineer-security-operations-ai-driven-defense"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/deriv-senior-security-operations-engineer-security-operations-ai-driven-defense\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fderiv-senior-security-operations-engineer-security-operations-ai-driven-defense"}]}