Security Engineer III – Security Operations

About the role

Primer is looking for a Security Engineer to help detect, investigate, and respond to threats across its cloud infrastructure. You will own a slice of detection and response capability, tuning SIEM alerts, building automation, and acting as a first responder when something looks wrong.

Key responsibilities

• Plan and deliver detection and response work end‑to‑end, from rule creation to fully automated response.
• Build, tune and maintain detections across the Elastic SIEM and AWS environment.
• Own an investigation queue: triage, investigate, escalate, resolve incidents and document findings.
• Develop runbooks and automations using Python and no‑code tools such as Zapier or Tines.
• Make and document risk decisions, involving others when needed.
• Support compliance by keeping controls audit‑ready and providing evidence for SOC 2, PCI DSS audits.
• Use Terraform and Python to build and maintain detection infrastructure.
• Participate in on‑call rotation for incident response and monitoring.

Required profile

• Hands‑on experience building and tuning detections in a SIEM (Elastic preferred; Splunk, Sentinel acceptable).
• Experience with AWS and cloud‑native detection and response.
• Comfortable scripting and automating with Python.
• Experience with Terraform or other infrastructure‑as‑code tools.
• Working knowledge of the MITRE ATT&CK framework.
• Proven ability to triage, investigate and resolve security incidents.
• Clear, structured written communication.

Required skills

• Elastic SIEM
• AWS
• Python
• Terraform
• MITRE ATT&CK
• Zapier
• Tines
• Splunk
• Sentinel

What we offer

• Fully remote, globally distributed work model.
• Competitive share options.
• Uncapped holiday with a minimum of 25 days.
• Co‑working space access in major cities.
• Workations and an annual company retreat.
• Best equipment for the role and £500 home‑office allowance.
• Generous learning budget.
• Private medical insurance.
• Additional location‑based perks.