Security Operations Engineer

About this role

Who We Are Yellow Card is the largest licensed Stablecoin-based infrastructure provider operating across over 60 countries. From Stablecoin payment infrastructure to fiat settlement rails, wallet services, and custom local Stablecoin issuance, Yellow Card provides the complete infrastructure businesses need to manage Stablecoins, payments, and operations across 50 emerging markets. Yellow Card operates with a substantial global team spanning 24 countries.

This workforce is characterized by its linguistic diversity, with collective speaking of over 25 languages, underscoring the company’s extensive international reach. The Security Operations Engineer is the operational backbone of the Security Operations Centre (SOC). It is a fully remote, hands-on, technical role that owns three tightly integrated domains: security alert design, triaging, and automated response; cloud security posture management across EKS and AWS environments; and posture tracking and reporting.

Reporting to the Associate Director, Product & Infrastructure Security, the engineer works alongside a mature Application Security team and collaborates closely with DevOps, Engineering, and Security GRC functions. The role sits within the First Line of Defense and is expected to progressively drive down manual effort through detection-as-code and SOAR automation. This is not a perimeter-security or scan-and-report role.

The right candidate must be comfortable writing detection logic, triaging cloud misconfigurations at the infrastructure level, and owning end-to-end vulnerability remediation cycles in containerised environments. What You'll Do 1. Security Operations The engineer owns the full lifecycle of security detection and response inside the SOC, from signal design through to automated containment. This is the primary domain of the role.

Alert design and coverage Design and maintain SIEM detection rules covering cloud, container, identity, and application layers, using both signature-based and behavioural logic Map detection coverage against the MITRE ATT&CK framework and identify gaps relevant to the organisation's AWS and EKS attack surface Integrate threat intelligence feeds to refresh rule logic for emerging threats and TTPs Maintain a detection backlog, prioritised by risk, with defined review cadences Alert triage Daily SIEM alert triage following defined response timing standard Classify, investigate, and resolve security signals; Reduce false-positive rates through structured tuning cycles, with documented rationale for rule changes Maintain triage runbooks for key production detection rules Automated response workflows (SOAR) Build and maintain SOAR playbooks for common alert types including IAM anomalies, misconfiguration alerts, exposed secrets, and container runtime events Automate enrichment steps (asset lookup, threat intel correlation, ownership resolution) to reduce analyst time-to-context Document automation logic and maintain version control for all playbooks Measure and report automation coverage rate as a standing KRI 2.