Description
We're looking for a Staff Security Operations Engineer to join our Cybersecurity team at Pleo. In this role, you'll define and deliver the SecOps roadmap, building the detection, response, and investigation capability that protects a fast-growing fintech.
As a Staff Security Operations Engineer, you will:
- Build and own a structured SecOps roadmap grounded in well-known frameworks such as MITRE ATT&CK, NIST, and CIS benchmarks.
- Lead security investigations and digital forensics, from suspicious traffic through to full incident response, and bring the findings back into how we detect and prevent.
- Design, tune, and scale our SIEM and logging pipeline through standardized log ingestion across services so signal isn't lost in the noise.
- Strengthen our perimeter and authentication posture, including WAF configuration, authorisation tuning, and monitoring for suspicious traffic.
- Protect sensitive data through DLP controls, and make sure the coverage matches where the data actually lives.
- Improve our on-call rotation for the team, defining the alerting, escalation paths, and response SLAs that make it work.
- Automate detection and response workflows, using code and AI to reduce manual toil and shorten time to resolution.
- Reduce SecOps-attributed risk identified through compliance gaps, and collect the evidence that demonstrates it.
- Build dashboards and reporting that give the team and leadership real visibility into response times, coverage, and risk reduction.
- Work cross-functionally with engineers who don't have a security background, translating threat models into changes they can actually ship.
You'll thrive in this role if you have:
- 10+ years of experience in security operations, incident response, or a closely related discipline, with a proven track record of materialised risk reduction through monetary impact, incidents contained, forensics that changed outcomes.
- A strong development and engineering background. You are comfortable writing the automation, not just specifying it.
- Hands-on SOC and SIEM management experience, including detection engineering and log pipeline design.
- Experience in scale-up environments, where you've built capability rather than inherited a mature one.
- A strong understanding of cloud architectures as we use AWS. With part of our estate on GCP and how infrastructure decisions shape detection and response.
- Demonstrated experience using AI and/or coding automation to get security controls built, implemented, and operating in practice.
- Fintech, payments, fraud, or trust & safety experience is a real advantage, as is exposure to highly regulated environments.
In your first 6 months at Pleo, you'll:
- Get deep into Pleo's security landscape and our detection coverage, our logging estate, our cloud footprint to form your own view of where the biggest risks sit.
- Publish a SecOps roadmap mapped to MITRE, NIST, and CIS, agree with Engineering, Risk & Compliance, and leadership, and start delivering against it.
- Stand up the on-call rotation and the alert response SLAs that go with it.
- Ship your first wave of detection and automation improvements, and establish the KPIs that show what changed.