Security Operations Engineer – Remote-First

Be part of a movement to change the way Europe pays

In today’s digital Europe, payments still feel too complicated. Random delays, confusing rules, extra apps and accounts make it harder than it should be to pay and get paid.

The European Payments Initiative is changing that with Wero, a proudly European digital wallet to make payments easier, clearer and more secure. Online, in store, at home and across borders, with your money and data protected under European laws and regulations.

Wero is live in Belgium, France, Germany and the Netherlands and launching very soon in Luxembourg and Austria. Backed by 17 major banks and the two largest European acquirers, we’re building a brand new, proudly European payment system. Why not join us?

What's in it for you

Play a key role in protecting Europe’s next-generation payment infrastructure. As an Operations Security Engineer, you will be at the heart of EPI's Security Operations capability: triaging alerts, responding to incidents, improving detection coverage and proactively hunting for threats across cloud, identity, endpoint and application environments.

This is a high-impact opportunity to combine hands-on SOC expertise, threat hunting and detection engineering in a remote-first, pan-European company where security directly supports the resilience and trust of Wero.

About the team

You’ll join the Security Operations team within Operations Services Delivery. The team brings together highly skilled security profiles, including SOC, IAM, general security, threat hunting and penetration testing expertise.

You’ll collaborate closely with Security, Engineering, DevOps, IT and Operations teams to strengthen detection and response capabilities, improve tooling and ensure strong visibility across our environments. This role is ideal for someone who enjoys hands-on investigation, structured incident response and clear communication with both technical and non-technical stakeholders.

Your impact

• Act as a central point of contact for alert triage, incident identification and security event investigation across EPI environments.

• Execute incident response activities using structured frameworks such as SANS PICERL, from preparation and identification through containment, eradication, recovery and lessons learned.

• Conduct proactive, hypothesis-driven threat hunts based on attacker behaviour, emerging threats, threat intelligence and MITRE ATT&CK techniques.

• Parse, analyse and correlate logs from authentication, application, system, endpoint and cloud telemetry sources, including AWS and Azure.

• Design, tune and maintain detection rules, use cases, dashboards, custom alerts and automation workflows to identify anomalies, lateral movement and persistent threats.

• Contribute to the development and continuous improvement of SOC playbooks, runbooks, SIEM and EDR integrations.

• Document and communicate threat findings, incident outcomes and remediation recommendations clearly to technical and non-technical stakeholders.

• Collaborate with engineering, SOC, IR and IT teams to improve detection coverage, response readiness and operational resilience.

Technology stack & way of working

• Primary security tools: Rapid7, Microsoft Defender, SIEM and EDR technologies

• Cloud, identity & operations: AWS, Azure, Microsoft Entra ID, Okta, PagerDuty

• Scripting, querying & automation: Python, PowerShell, KQL, custom alerting and auto-remediation workflows

• Collaboration & delivery: Jira, Confluence, GitHub

To succeed, you should meet at least 70% of these requirements

• +8 years of experience in cybersecurity, with strong hands-on experience as a SOC analyst, incident responder, detection engineer or similar role.

• Fluent in English (CEFR C1 or C2); French, German, Dutch or other European languages are a plus.

• Thrive in a remote-first, multicultural and fast-paced environment.

• Strong familiarity with the full SOC lifecycle, from Tier 1 to Tier 3, including alert triage, incident response, threat hunting and threat intelligence.

• Proven experience in threat hunting, detection engineering or threat intelligence, with the ability to turn attacker behaviours into actionable detections.

• Solid understanding of SIEM and EDR technologies, log parsing, detection engineering and alert tuning.

• Hands‑on experience with scripting and querying tools such as Python, PowerShell or KQL to support automation, investigations and custom alerting.

• Ability to analyse and correlate logs from diverse sources, including authentication, application, system and cloud tele