Senior Security Operations Engineer

About the role

Deriv is building an autonomous security operations platform that proactively hunts threats, responds automatically, and continuously learns. As a Senior Security Operations Engineer you will lead the design, implementation and automation of detection, response and hardening across a global, 24/7 trading environment.

Key responsibilities

• Develop and optimise SIEM rules, AI‑driven anomaly baselines and automated alert enrichment to surface high‑value threats early.
• Conduct threat‑hunting investigations using behavioural analytics, log forensics and threat intelligence.
• Automate incident response workflows and runbooks with Python, Bash or Terraform to contain threats within minutes.
• Assess and harden cloud, endpoint, network and application layers against MITRE ATT&CK, CIS and NIST benchmarks.
• Integrate security controls into CI/CD pipelines, container security and DevOps processes.

Required profile

• 8+ years of experience in security operations, incident response or blue‑team work.
• Proven track record of reducing false positives and building custom detection logic.
• Hands‑on automation experience – scripting repetitive tasks in Python, Bash or Terraform.
• Deep understanding of AI/ML‑based security models, UEBA and their practical limits.
• Strong communication skills to translate technical risk into actionable decisions for engineering and leadership.

Required skills

• Python, Bash, Terraform
• SIEM rule development and tuning
• EDR/XDR platforms, UEBA, behavioural analytics
• Cloud security posture management on AWS, GCP or Azure
• Identity & Access Management tools such as Okta, Google Workspace, Azure AD
• WAF/CDN configuration and API abuse mitigation