Detection And Response Engineer

Role Overview

• Moniepoint is looking for an experienced Detection and Response Engineer to join our Incident Response team.
• The role suits someone who has moved beyond first-line triage and wants to lead investigations from start to finish, then use what they learn to improve our detections.
• You'll triage and investigate security incidents, write and tune detection rules in our Detection-as-Code pipeline, and automate detection and response work.
• You'll work closely with the Lead to close detection gaps, drive down MTTD/MTTR, and grow toward deeper detection engineering and IR ownership across Moniepoint Group

Key Responsibilities

Security Incident Response:

• Own escalated security incidents end-to-end, including scoping, evidence collection, threat analysis, containment, and remediation
• Analyze and reverse engineer malware to understand its behavior, extract Indicators of Compromise (IOCs), identify Tactics, Techniques, and Procedures (TTPs), and determine appropriate detection and response
• Conduct threat hunting using existing detection content, threat intelligence, and independent hypothesis-driven analysis
• Review and provide feedback on reported security incidents

Detection Engineering:

• Write, test, and deploy detection rules (YARA-L or equivalent) through the team's CI/CD Detection-as-Code pipeline
• Tune existing detections to reduce false positives, using incident and hunting findings as the primary signal for what needs fixing
• Identify detection gaps surfaced during investigations and translate them into new rule proposals
• Build and maintain SOAR playbooks and security automation, including AI-driven and agentic workflows, to automate alert triage, enrich investigations, and speed up incident response.
• Participate in tabletop, purple-team, and threat-intel-driven simulation exercises, including scenario execution and converting findings into new detections
• Translate relevant threat intelligence into new detection opportunities or hunting hypotheses

Collaboration & Documentation:

• Work cross-functionally with cloud security, infrastructure, and development teams to close systemic gaps identified during investigations
• Maintain accurate records for incidents, detection changes, and threat intelligence, and keep the playbook library current
• Document new detection logic and rule changes to a standard that supports peer review and audit

Compliance & Continuous Improvement:

• Ensure IR and detection engineering practices align with PCI-DSS, ISO 27001, and NIST CSF 2.0
• Stay current with cybersecurity trends and threat landscape shifts, and proactively implement IR or detection process improvements

Log Integration, Visibility, & Threat Modeling:

• Drive log source onboarding and ingestion health across enterprise applications and cloud environments; identify critical visibility gaps; and coordinate remediation with relevant teams.
• Lead threat modeling exercises for critical infrastructure and translate findings into high-fidelity detection rules and proactive threat hunting hypotheses
• Implement and maintain automated event enrichment pipelines to enhance context for security investigations and improve analyst efficiency.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field (or equivalent hands-on experience)
• 2 - 4 years of experience in incident response, SOC operations, or detection engineering
• Demonstrated experience writing or tuning detection rules in a SIEM (Google SecOps, or similar), using a rule language such as YARA-L, CQL, KQL, or Sigma
• Solid experience with SIEM and EDR platforms, log analysis, and end-to-end incident triage/investigation
• Working knowledge of MITRE ATT&CK and how it maps to detection coverage
• Comfortable with Python, JavaScript, or a similar scripting language for automation and detection support work
• Strong written communication skills for incident reports and detection documentation

Preferred Skills & Certifications:

• Experience with SOAR platforms or building automation for triage/enrichment
• Exposure to multi-cloud environments (GCP, AWS) and fintech/financial-sector threats
• Foundational digital forensics or malware analysis experience
• GCIH, CySA+, or equivalent IR/detection engineering certifications

What We Offer

• A clear path toward senior detection engineering and IR ownership
• Direct mentorship from a Lead who owns the full detection-as-code and automation stack
• Competitive compensation and benefits
• Exposure to real-world fintech security challenges
• The opportunity to build detection capability that protects systems impacting millions of users.

What we can offer you

• Culture -We put our people first and prioritize the well-being of every team member. We've built a company where all opinions carry weight and where all voices are heard. We value and respect each other and always look out for one another. Above all, we are human.
• Learning - We have a learning and development-focused environment with an emphasis on knowledge sharing, training, and regular internal technical talks.
• Compensation - You'll receive an attractive salary, pension, health insurance, annual bonus, plus other benefits.

What to expect in the hiring process

• A preliminary phone call with the recruiter
• A technical interview with a Team Lead
• A behavioural and technical interview with a member of the Executive team.