Security & Threat Operations Engineer

Join OnePay, a fast-moving fintech company, as a Security and Threat Operations Engineer. In this role, you will have a direct impact on protecting our business and customers by turning production signals into actionable detection, response, and hardening initiatives. You will work closely with various teams, build and tune detections, review traffic patterns, and investigate security events. The position offers competitive health benefits, flexible time off, a 401k plan with employer match, and a remote-first culture.

• Transform production signals into actionable detection, response, and hardening initiatives, collaborating with various teams.
• Build and tune detections, alerts, and monitoring workflows across cloud, application, identity, and edge environments.
• Investigate security events end to end, including triage, scoping, containment support, and follow-through on remediation.

• Demonstrated ability to review traffic and event patterns for signs of malicious activity, fraud, account abuse, credential attacks, reconnaissance, and exploitation attempts
• Experience operating or supporting a vulnerability management program, including triage, prioritization, remediation tracking, and stakeholder coordination
• Experience building and tuning detections in a SIEM or detection platform and working with observability and logging systems such as CloudWatch, Datadog, or similar platforms
• Excellent analytical, communication, and cross-functional collaboration skills, especially in environments where security needs to move quickly with product and engineering teams
• Practical experience using AI tools in security workflows, along with sound judgment about AI-specific risks such as prompt injection, data leakage, excessive tool access, and weak auditability
• Strong Python programming skills and the ability to write maintainable code for automation, enrichment, analysis, and security operations tooling
• Strong understanding of threat modeling, risk prioritization, and practical security controls across applications, infrastructure, and cloud environments
• Working knowledge of identity and access systems, modern authentication flows, and the security implications of internet-facing applications and APIs
• Strong experience investigating suspicious activity in web, API, authentication, and infrastructure telemetry, with the ability to distinguish attacker behavior from normal production noise
• Familiarity with cloud and application security findings from platforms such as Wiz, including CNAPP, runtime, code, and vulnerability scanning use cases
• Experience with at least one major cloud provider, preferably AWS
• Drive and proactivity - everyone here is a builder and executor
• 5+ years of experience in information security, threat detection, security operations, detection engineering, or incident response, ideally in a cloud-native or product-focused environment