{"id":696401,"url":"https://alion.io/job/yellow-card-security-operations-engineer","title":"Security Operations Engineer","company":{"id":47641,"name":"Yellow Card","domain":"yellowcard.io","url":"https://alion.io/company/yellow-card","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"BambooHR","truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"CloudFormation","optional":false},{"name":"CVSS","optional":false},{"name":"Datadog","optional":false},{"name":"GDPR","optional":false},{"name":"IAM","optional":false},{"name":"ISO 27001","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Orca Security","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"SOC 2","optional":false},{"name":"Terraform","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-06-23T00:00:00Z","employer_posted_date":"2026-06-23","last_verified_at":"2026-10-18T13:02:21Z","board_verified":true,"closed_at":null,"days_open":117,"trust":{"level":"stale","repost_count":1,"flags":["stale"],"days_open":117},"description":"Who We Are\nYellow Card is the largest licensed Stablecoin-based infrastructure provider operating across over 60 countries. From Stablecoin payment infrastructure to fiat settlement rails, wallet services, and custom local Stablecoin issuance, Yellow Card provides the complete infrastructure businesses need to manage Stablecoins, payments, and operations across 50 emerging markets.\nYellow Card operates with a substantial global team spanning 24 countries. This workforce is characterized by its linguistic diversity, with collective speaking of over 25 languages, underscoring the company’s extensive international reach.\nThe Security Operations Engineer is the operational backbone of the Security Operations Centre (SOC). It is a fully remote, hands-on, technical role that owns three tightly integrated domains: security alert design, triaging, and automated response; cloud security posture management across EKS and AWS environments; and posture tracking and reporting.\nReporting to the Associate Director, Product & Infrastructure Security, the engineer works alongside a mature Application Security team and collaborates closely with DevOps, Engineering, and Security GRC functions. The role sits within the First Line of Defense and is expected to progressively drive down manual effort through detection-as-code and SOAR automation.\nThis is not a perimeter-security or scan-and-report role. The right candidate must be comfortable writing detection logic, triaging cloud misconfigurations at the infrastructure level, and owning end-to-end vulnerability remediation cycles in containerised environments.\nWhat You'll Do\n1. Security Operations\nThe engineer owns the full lifecycle of security detection and response inside the SOC, from signal design through to automated containment. This is the primary domain of the role.\nAlert design and coverage\nDesign and maintain SIEM detection rules covering cloud, container, identity, and application layers, using both signature-based and behavioural logic\nMap detection coverage against the MITRE ATT&CK framework and identify gaps relevant to the organisation's AWS and EKS attack surface\nIntegrate threat intelligence feeds to refresh rule logic for emerging threats and TTPs\nMaintain a detection backlog, prioritised by risk, with defined review cadences\nAlert triage\nDaily SIEM alert triage following defined response timing standard\nClassify, investigate, and resolve security signals; \nReduce false-positive rates through structured tuning cycles, with documented rationale for rule changes\nMaintain triage runbooks for key production detection rules\nAutomated response workflows (SOAR)\nBuild and maintain SOAR playbooks for common alert types including IAM anomalies, misconfiguration alerts, exposed secrets, and container runtime events\nAutomate enrichment steps (asset lookup, threat intel correlation, ownership resolution) to reduce analyst time-to-context\nDocument automation logic and maintain version control for all playbooks\nMeasure and report automation coverage rate as a standing KRI\n2. Cloud Security Posture Management\nCloud posture management is the infrastructure-facing domain of the role, covering vulnerability management, identity governance, and configuration and change control. AWS EKS and Serverless resources are the primary environments.\nVulnerability management\nOwn the end-to-end vulnerability triage process for cloud and container environments, prioritising findings by business impact using CVSS scoring, asset criticality, and exploitability context\nManage EKS-specific vulnerability coverage: base image currency, workload scanning results, pod security standards compliance, and node group patching cadence\nCoordinate remediation with engineering teams by opening well-scoped tickets, tracking progress, and escalating SLA breaches\nMaintain MTTR and SLA compliance data by severity tier\nOversee CSPM posture score targets; triage new Critical findings within defined SLA windows\nIdentity and access governance\nReview and approve IAM policy changes, enforcing least-privilege and flagging over-permissioned roles or service accounts\nExecute scheduled IAM hygiene reviews: unused credentials, stale access keys, overly broad policies, and cross-account trust boundaries\nGovern workload identity configurations in EKS, ensuring service accounts carry only the permissions required\nSupport the secrets rotation program and enforce zero hardcoded credentials across the estate\nConfiguration and change management\nReview and approve cloud network security changes: security group modifications, network ACL changes, and routing updates\nOwn container image security: base image update cadence, scanning results review, and image ownership classification\nInvestigate and remediate misconfiguration alerts surfaced by CSPM tooling within defined SLA windows\nMaintain a configuration baseline for critical cloud resources and flag drift\n3. Posture Tracking and Reporting\nThe engineer is the primary data owner for security posture metrics across both SOC and cloud domains. Reporting outputs feed executive dashboards, GRC compliance evidence, and quarterly risk reviews.\nKRI data collection\nCollect and maintain Key Risk Indicator data across all three KRA domains on defined cadences\nSOC KRIs: MTTA (Mean Time to Acknowledge), MTTR, false-positive rate, automation coverage rate, detection coverage score\nVM KRIs: Critical/High finding counts, SLA compliance rate by severity, MTTR by tier, overdue remediation count\nPosture KRIs: CSPM score, under-protected asset count, misconfiguration closure rate, IAM hygiene score, log source coverage\nRecurring control reviews\nExecute infrastructure security control checks on weekly (CSPM critical findings), monthly (IAM hygiene, secrets rotation status), and quarterly (posture benchmark, detection coverage review) cadences\nProduce structured findings reports for each review cycle, flagging control failures for escalation\nReporting\nProvide SOC and cloud posture metrics, including trends, at the required reporting cycles\nSupport external audit and due diligence processes by providing evidence artefacts\n4. Others\nCo-own the shared vulnerability backlog (infrastructure side) with the Application Security team, ensuring consistent prioritisation methodology across domains\nServe as the infrastructure and identity SME for the AppSec team during application security assessments and architecture reviews\nOwn infrastructure containment during incidents that span application and infrastructure layers, working alongside AppSec for root cause analysis\nProvide infrastructure, identity, and network security review for new third-party integrations prior to deployment\nCollaborate with the Security GRC function on control evidence and compliance mapping, particularly for SOC 2, ISO 27001, and GDPR requirements\nWhat You'll Bring\nFluency in English, both written and verbal\nAbility to collaborate with cross-functional teams and across different time zones\n3 to 5 years of experience in security operations, cloud security, or infrastructure security engineering\nHands-on AWS security experience: IAM policy design, virtual network architecture, cloud-native security services, CloudTrail, GuardDuty\nKubernetes and EKS security experience: pod security standards, network policy enforcement, workload identity, image scanning\nSIEM operations: alert triage, detection rule authoring (signature-based and behavioural), log analysis and correlation\nVulnerability management: CSPM tooling, risk-based prioritisation, CVSS scoring, SLA framework operation\nIaC security: ability to read and review Terraform or CloudFormation for misconfigurations\nIncident response: investigation, containment, and post-incident reporting\nExperience in a regulated environment (FinTech, payments, banking, or crypto preferred)\nAbility to author and tune detection rules without relying on vendor-supplied defaults\nStructured written communication for triage reports, post-incident write-ups, and stakeholder metrics\nAbility to coordinate remediation across engineering teams without direct authority\nComfort operating in a lean team where domain boundaries are broader than in large enterprise security functions\nProfessional certifications: AWS Security Specialty (highly valued)\nExperience with CSPM and SIEM platforms: Datadog, Wiz, Orca Security\nExperience with secrets management platforms: AWS Secrets Manager\nFamiliarity with compliance frameworks: SOC 2, ISO 27001, GDPR, DORA\nScripting ability in Python or Bash for detection-as-code and operational automation\nExperience with SOAR or workflow automation platforms\nUnderstanding of cryptocurrency or blockchain security considerations\nExperience in a startup or scale-up environment\nAI tooling familiarity and interest in applying AI to operational workflows\nWhat We Offer\nCompensation & Benefits: We offer competitive compensation and meaningful health coverage, and all full-time employees are participants in our stock option plan.\nLearning & Development: Access to resources, support, and autonomy to grow professionally.\nRemote-First Flexibility: We embrace a fully remote work environment.\nRegulated, multi-geography environment with real-world impact on financial inclusion\nMental Health Support Services: Your mental well-being matters to us.\nOwnership of the SOC and cloud security posture function from day one, in a high-growth FinTech environment\nBroad domain exposure: detection engineering, cloud security, container security, incident response, and compliance\nCollaborative team culture with a mature AppSec function and strong leadership support\nReady to Join Us?\nAre you up for the challenge? Apply today and be part of shaping the future of FinTech. Let's innovate, disrupt, and lead together!","description_format":"text","description_chars":9784,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Crypto Exchanges"],"lifecycle":[{"event":"open","at":"2026-09-11T02:00:29Z"},{"event":"close","at":"2026-10-08T17:24:43Z"},{"event":"reopen","at":"2026-10-13T09:21:37Z"}],"visa":[],"liveness":{"score":8,"band":"cold","label":"Long shot","p_open":1,"p_active":0.268,"p_room":0.28,"age_days":116,"expected_fill_days":33,"reasons":["conf:1","win:tail","crowd:"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/yellow-card-security-operations-engineer","json_url":"https://alion.io/job/yellow-card-security-operations-engineer.json","meta":{"generated_at":"2026-10-18T15:50:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":21778,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":47641},"rest":"https://alion.io/mcp/rest/get_company?id=47641"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fyellow-card-security-operations-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fyellow-card-security-operations-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fyellow-card-security-operations-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/yellow-card-security-operations-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fyellow-card-security-operations-engineer"}]}