Senior SecOps Engineer

We are looking for a Lead SecOps Engineer to design and build security operations for a regulated payments group: the SIEM, the vulnerability management programme, and the security incident process. You will own the technical direction of the detection and response stack, and operate with a high degree of independence. Reporting to: Head of Information Security.

Responsibilities

Design, build and operate our SIEM from the ground up — architecture, deployment, tuning and run; Establish attack-surface monitoring: continuous discovery and review of what the group exposes to the internet; Build AI-assisted triage and enrichment into the pipeline from the start: agent-based alert handling, correlation summaries, draft incident timelines; Stand up the vulnerability management programme: deployment, asset coverage, risk-based prioritization, remediation SLAs and reporting; Implement process and procedures to ensure an effective vulnerability lifecycle; Operate and continuously improve the security incident process end to end: detection, classification, response, post-incident review; Develop and maintain runbooks, playbooks and event handlers — and automate them wherever they repeat; Harden and monitor our AWS estate: GuardDuty, Security Hub and native findings triaged, deduplicated and driven to remediation; Drive security hardening across our infrastructure and runtime security; Automate routine security operations aggressively — scripting, APIs, infrastructure-as-code and AI agents are all fair game; Run proof-of-concepts, evaluate tooling and shape the technical roadmap of the security stack; Provide security engineering consultancy to Engineering, IT and DevOps teams

Requirements

5+ years in security operations or security engineering in financial services or another environment with formal incident-reporting obligations (DORA, PCI DSS); Strong hands-on experience with SIEM platforms (Elastic/OpenSearch, Wazuh, Splunk or similar) and log pipeline engineering; Solid AWS security knowledge: GuardDuty, Security Hub, IAM, VPC-level controls and cloud-native logging, hardening; Practical experience running vulnerability management: scanners, prioritisation, remediation tracking; Strong IaaC skills; Genuine enthusiasm for AI-assisted security operations — using LLMs and agents to triage, enrich, summarise and automate is core to how this role works; The independence to own a domain end to end: prioritise, decide, deliver and explain

Nice to have

Kubernetes security hands-on: admission controllers, runtime detection (Falco or similar), cluster hardening; Detection-as-code practices (Sigma, version-controlled rules, CI for detections); Certifications such as CCSP, CISSP, OSCP or equivalent

Benefits

Provident Fund after probation; Annual Learning Budget for professional development after probation; €150 monthly Wolt allowance; SportsBenefits membership; Company car eligibility after one year; Complimentary parking space; 25 days of vacation + public holidays + 10 days of sick leave; Exclusive local discount card + tickets for events; Free Greek language classes twice a week; Company celebrations; Global Collaboration & Events