[Hiring] Senior InfoSec Engineer - Detection & Response @Qivalis

Role Description

As Senior InfoSec Engineer, Detection & Response (m/f/d) at Qivalis, you own how we detect and respond to attacks on our critical systems. You build and maintain the detections in our SIEM, grounded in our threat models and the threat landscape for digital assets and payments. When something happens, you lead the technical response, from triage and containment to forensically sound evidence and clear documentation that stands up to auditors and regulators.

You join a small, remote first-line security team that works async-first, working closely with Platform Engineering on containment and with our Security Architect on turning threat models into better detections. You own the runbooks, evidence and metrics that show how well we detect and respond. This role requires a paid on-call rotation of one week per month, covering critical and high incidents and emergency change approvals, including outside business hours.

Responsibilities

• Write, test and tune detection rules in our SIEM based on our threat models and the threat landscape for digital assets and payments.
• Lead the technical response to security incidents: triage alerts, contain threats on EDR, identity provider and SaaS tooling, and trigger pre-approved containment playbooks in the platform with Platform Engineering.
• Collect and preserve evidence in a forensically sound way, document every incident and keep incident runbooks current, automating response steps where it makes sense.
• Review security dashboards daily, monitor EDR and device compliance, and investigate endpoint and identity threat alerts.
• Monitor custody platform audit logs for policy changes, new API users and whitelist changes, and detect shadow AI use and data leakage.
• Measure and improve detection coverage of critical systems, false-positive rates and time to detect, and turn threat models and purple-team exercises into better detections together with our Security Architect.
• Take your turn on the security on-call rotation one week per month: support high and critical incidents and approve emergency deployments.
• Support post-incident reviews and root-cause-analysis.

Qualifications

• 5+ years in security operations, detection engineering or incident response, ideally in a regulated environment such as financial services or payments.
• Hands-on experience writing and tuning SIEM detection rules and queries.
• Hands-on EDR experience, including investigating and containing endpoint threats.
• Practical experience leading incident response from triage to closure, including evidence handling and clear documentation.
• Working knowledge of AWS and Kubernetes audit logs and identity provider logs.
• Ability to work independently in a remote, async-first team and to communicate clearly with technical and non-technical colleagues, including during an incident.
• Excellent written and spoken English.

Nice to Have

• Digital forensics experience: host, cloud and container artefact acquisition and analysis, timeline reconstruction and chain of custody.
• Detection-as-code practices and scripting in Python, Bash or comparable.
• Familiarity with MITRE ATT&CK and threat-informed detection.
• Experience with SOAR or response automation.
• Offensive security or purple-team experience: adversary emulation, attack technique validation, or a red-team/pentest background used to improve detections.
• Exposure to digital assets, custody platforms or blockchain monitoring.
• Involvement in threat intelligence or financial-sector information sharing communities.
• Certifications such as GCIH, GCIA or GCFA.

Core Competencies

• Calm under pressure: You analyse information quickly, decide on next steps and respond in a structured way, also when an incident happens outside business hours.
• Thoroughness and accuracy: You get the details right in detection rules, investigations and incident records, knowing that auditors and the regulator may review them.
• Reliability and follow-through: You close the loop on every alert and incident and turn what you learn into better detections and runbooks.
• Clear communication: You give short, clear updates during an incident so engineers and management know what is happening and what comes next.
• Collaboration: You work closely with Platform Engineering, our Security Architect and your fellow InfoSec Engineer, and you cover for each other when needed.

Application Process

• Screening call: A short call with our Talent Acquisition team to learn more about Qivalis and the team, and for us to get to know your background and motivation.
• Hiring Manager interview: A deep dive into the role with our Head of Security Compliance & Operations, covering its responsibilities, priorities, and how your experience fits.
• Technical interview: A hands-on case study with our Head of Security Compliance & Operations and our CTO, where you’ll work through a realistic security incident based on challenges we face.
• Team interview: A conversation with members of our Platform Engineering team about how you would work together on detection and containment.
• Cultural-Add call: A final conversation with our Head of HR about what you’d bring to the team: your perspective, values, and approach.