Senior InfoSec Engineer - Detection & Response (m/f/d)
About This Role
As Senior InfoSec Engineer, Detection & Response, you will own how Qivalis detects and responds to attacks on its critical systems. You'll build and maintain detections in the SIEM, grounded in threat models and the threat landscape for digital assets and payments. When incidents occur, you'll lead the technical response — from triage and containment through to forensically sound evidence collection and documentation that holds up to auditors and regulators.
What You'll Be Doing
Write, test and tune SIEM detection rules based on threat models and the threat landscape for digital assets and payments, so attacks on critical systems are caught early.
Lead the technical response to security incidents: triage alerts, contain threats across EDR, identity provider and SaaS tooling, and trigger pre-approved containment playbooks in the platform alongside Platform Engineering.
Collect and preserve evidence in a forensically sound manner, document every incident, and keep incident runbooks current, automating response steps where possible.
Review security dashboards daily, monitor EDR and device compliance, and investigate endpoint and identity threat alerts.
Monitor custody platform audit logs for policy changes, new API users and whitelist changes, and detect shadow AI use and data leakage.
Measure and improve detection coverage of critical systems, false-positive rates and time to detect, turning threat models and purple-team exercises into better detections together with the Security Architect.
Take your turn on the security on-call rotation one week per month, supporting high and critical incidents and approving emergency deployments.
Support post-incident reviews and root-cause analysis.
What We're Looking For
5+ years in security operations, detection engineering or incident response, ideally within a regulated environment such as financial services or payments.
Hands-on experience writing and tuning SIEM detection rules and queries.
Hands-on EDR experience, including investigating and containing endpoint threats.
Practical experience leading incident response from triage to closure, including evidence handling and clear documentation.
Working knowledge of AWS and Kubernetes audit logs and identity provider logs.
Ability to work independently in a remote, async-first team and communicate clearly with both technical and non-technical colleagues, including during incidents.
Excellent written and spoken English.
Bonus Points
Digital forensics experience: host, cloud and container artefact acquisition and analysis, timeline reconstruction and chain of custody.
Detection-as-code practices and scripting in Python, Bash or comparable languages.
Familiarity with MITRE ATT&CK and threat-informed detection.
Experience with SOAR or response automation.
Offensive security or purple-team experience: adversary emulation, attack technique validation, or a red-team/pentest background applied to improving detections.
Exposure to digital assets, custody platforms or blockchain monitoring.
Involvement in threat intelligence or financial-sector information sharing communities.
Certifications such as GCIH, GCIA or GCFA.
Ready to Apply?
To submit your application for this position, please visit Qivalis's official website and follow their application process.