Senior SecOps Engineer

The role is about:

We are looking for a Lead SecOps Engineer to design and build security operations for a regulated payments group: the SIEM, the vulnerability management programme, and the security incident process. You will own the technical direction of the detection and response stack, and operate with a high degree of independence.

•Location: Limassol, Cyprus or Remote from Poland or Portugal

•Reporting to: Head of Information Security

What will you do:

•Design, build and operate our SIEM from the ground up — architecture, deployment, tuning and run

•Establish attack-surface monitoring: continuous discovery and review of what the group exposes to the internet

•Build AI-assisted triage and enrichment into the pipeline from the start: agent-based alert handling, correlation summaries, draft incident timelines

•Stand up the vulnerability management programme: deployment, asset coverage, risk-based prioritization, remediation SLAs and reporting

•Implement process and procedures to ensure an effective vulnerability lifecycle.

•Operate and continuously improve the security incident process end to end: detection, classification, response, post-incident review

•Develop and maintain runbooks, playbooks and event handlers — and automate them wherever they repeat

•Harden and monitor our AWS estate: GuardDuty, Security Hub and native findings triaged, deduplicated and driven to remediation

•Drive security hardening across our infrastructure and runtime security

•Automate routine security operations aggressively — scripting, APIs, infrastructure-as-code and AI agents are all fair game

•Run proof-of-concepts, evaluate tooling and shape the technical roadmap of the security stack

•Provide security engineering consultancy to Engineering, IT and DevOps teams

What we need:

•5+ years in security operations or security engineering in financial services or another environment with formal incident-reporting obligations (DORA, PCI DSS)

•Strong hands-on experience with SIEM platforms (Elastic/OpenSearch, Wazuh, Splunk or similar) and log pipeline engineering

•Solid AWS security knowledge: GuardDuty, Security Hub, IAM, VPC-level controls and cloud-native logging, hardening

•Practical experience running vulnerability management: scanners, prioritisation, remediation tracking

•Strong IaaC skills

•Genuine enthusiasm for AI-assisted security operations — using LLMs and agents to triage, enrich, summarise and automate is core to how this role works.

•The independence to own a domain end to end: prioritise, decide, deliver and explain

Nice to have:

•Kubernetes security hands-on: admission controllers, runtime detection (Falco or similar), cluster hardening

•Detection-as-code practices (Sigma, version-controlled rules, CI for detections)

•Certifications such as CCSP, CISSP, OSCP or equivalent

Hiring Process: …

This listing comes from the employer's own careers page. Apply with the button on this page; it opens the employer's form. CyprusJobs.eu does not receive applications for this role.