Security Engineer III - Detection & Response

Primer is the unified infrastructure for global payments. We give finance and payments teams the visibility and control to reduce complexity, improve performance, and capture more revenue - all from a single platform.

Backed by Sofina, Peak XV Partners, ICONIQ, Tencent, Accel, and Balderton, we're building the payments layer the world's best companies rely on.

Watch our showcase > -showcase

Read up on our $100m Series C https://(Use the "Apply for this Job" box below).-c

Learn more about our culture > /careers

Primer is looking for a Security Engineer to help us detect, investigate, and respond to threats across our cloud infrastructure. You'll take ownership of a meaningful slice of our detection and response capability — tuning what our SIEM catches, building the automation that speeds up how we react, and being a first responder when something looks wrong.

• Plan and deliver detection and response work end-to-end — from a new detection rule to a fully automated response — within your area of ownership.
• Build, tune and maintain detections across our SIEM (Elastic) and AWS environment, closing gaps that existing coverage misses.
• Own an investigation queue: triage, investigate, elevate and resolve security incidents, and write up findings clearly enough to stand on their own.
• Build runbooks and automations (Python, and no-code tools like Zapier or Tines) to cut manual work out of triage and response.
• Make and document risk decisions in your area, and know when to pull in others.
• Support our compliance programme by keeping the controls you own audit-ready and contributing evidence for audits (e.g. SOC 2, PCI DSS).
• Use Terraform and Python to build and maintain the infrastructure behind your detections and tooling.
• Join our on-call rotation for incident response and monitoring.

• Hands-on experience building and tuning detections in a SIEM (Elastic preferred; Splunk, Sentinel or similar also welcome)
• Experience with AWS and cloud-native detection and response
• Comfortable with Python for scripting and automation
• Experience with Terraform or other infrastructure-as-code
• Working knowledge of MITRE ATT&CK
• Real experience triaging, investigating and resolving security incidents
• Clear, structured written communication

• Experience with no-code security automation / SOAR-style tooling
• Exposure to compliance frameworks like PCI DSS, SOC 2 or ISO 27001
• Background in fintech, payments or another regulated industry

• An initial intro call with a Talent Partner
• An interview with the Hiring Manager
• Challenge Stage - Contextualised to the role
• A final, values-alignment interview

We're building a culture where people can do their best work and be proud of the impact they have. You'll be working with people who are mission-driven, smart, and reflective, and who are genuinely invested in building exceptional products and delivering success for our merchants.

We work remotely, and have done since day one. We believe that building a successful, profitable company goes beyond proximity. We invest in our relationships through great remote working practices and thoughtfully designed face-to-face time, including workations, our annual company retreat, and access to co-working spaces across most major cities.

The work is challenging. Scaleups are a challenge, and building category-defining products is a challenge. But there's a meaningful difference between a challenge and a struggle. At Primer, the right challenge comes with the right support: strong onboarding, a collaborative environment, and a team that is genuinely invested in your success. It's never something you face…