Security Engineer, Detection and Security Operations

About the role

Reap is building a multi‑rail financial connectivity platform and needs a pragmatic security engineer to design and operate its detection capabilities. You will lead the creation of a SIEM solution, ingest critical telemetry, and turn threat intelligence into actionable detection rules to protect the company 24/7.

Key responsibilities

• Evaluate, select, and deploy a SIEM platform, driving end‑to‑end production detection capability.
• Ingest logs from CrowdStrike, AWS CloudTrail, Okta, Microsoft 365 and other SaaS applications.
• Write and maintain detection rules for known TTPs such as Lazarus Group C2 beaconing, credential harvesting, lateral movement, cloud misconfigurations, and AI data exfiltration.
• Own alert triage, define SLAs, reduce false positives, and hand off confirmed incidents to the Crypto/IR Security Engineer.
• Operationalise threat intelligence feeds, extracting IOCs and translating them into detection logic on a regular cadence.
• Build security metrics dashboards and automated reports for the CISO board pack (mean detection time, response time, alert volume, coverage gaps).
• Support and integrate CrowdStrike Falcon and related security tooling.

Required profile

• Hands‑on experience building detection infrastructure and operating security operations.
• Ability to translate regulatory requirements and threat actor behavior into robust security controls.
• Strong collaboration skills to work with engineering, risk, and operations teams.
• Comfort with a fast‑moving, global, 24/7 environment.

Required skills

• SIEM platform evaluation and deployment (e.g., Splunk, Elastic, or similar).
• CrowdStrike Falcon log integration.
• AWS CloudTrail log handling.
• Okta authentication logs.
• Microsoft 365 telemetry.
• Detection rule authoring and tuning.
• Threat intelligence feed consumption and IOC extraction.
• Security metrics dashboard creation.