Senior Security Engineer, Detection & Response at Sezzle

Job description

The salary range for this role is $5,000 - $9,500 per month (Gross in USD) About Sezzle: With a mission to financially empower the next generation, Sezzle is revolutionizing the shopping experience beyond payments, blending cutting-edge tech with seamless, interest-free installment plans that make shopping smarter and more accessible. We’re not just transforming payments; we’re redefining how people discover, interact with, and purchase the things they love while driving real impact on merchant sales through increased conversions and higher order values. As we continue to shape the future of fintech and retail, we’re building an innovative, dynamic team passionate about creating more than just a transaction but a truly unique shopping journey. If you’re excited about pushing boundaries in tech and delivering a game-changing experience for consumers and merchants alike, come join us at Sezzle and help create the future of shopping! Compensation : For this principal development role, with 6+ years of experience, the compensation range is $5,000 - $9,500 USD per month, based on experience level and gross amount. This range acknowledges the extensive expertise, leadership capabilities, and significant contributions expected at this level, offering a competitive salary to reflect the value of advanced skills and experience About the Role: We are seeking a hands-on, high-impact Senior Security Engineer, Detection & Response , to strengthen security operations at Sezzle: detection, incident response, and vulnerability management across our cloud infrastructure and applications. You will join the team that runs our SIEM and detection capability — from log ingestion and audit coverage to detection rules, alert tuning, and investigation workflows — so that access to sensitive systems is attributable and suspicious activity is caught and attributed by our own detections. You will operate the vulnerability-management loop end-to-end, and when incidents happen, you will lead the investigation and see the long-term fix through. You should consider yourself a DOer - someone who is comfortable diving into logs, analyzing systems, validating findings, and working end-to-end to get issues resolved. You will report to the Director of Information Security and work alongside the engineers who own the security platform and network and zero trust — your detection and response work is what proves their controls hold. This role is ideal for someone who thrives in a fast-paced environment and wants to work on real-world security problems at scale. At Sezzle, AI-assisted engineering is a standard part of how we work. In this role you will use and build agentic workflows for alert triage, investigation, and threat hunting that multiply what the team can cover. What You’ll Do: Build, operate, and mature SIEM/XDR capabilities, including log ingestion, detection rule development, alert tuning, and investigation workflows Design and implement detection strategies for suspicious activity, including data exfiltration patterns using application and database telemetry Extend audit and attribution coverage across the estate — Kubernetes audit logs, database audit logging, SSO and access-path telemetry — so access to sensitive data is attributable to a person or workload, with retention aligned to compliance requirements Investigate and respond to security incidents across cloud infrastructure and applications, performing root cause analysis and driving long-term fixes Run proactive threat hunts across cloud and identity planes, building agentic hunting workflows that make hunts repeatable Operate vulnerability management across infrastructure, platforms, and applications - including internal scans, dependency analysis, and external findings, validating true positives and driving remediation with engineering teams Triage and validate external security findings (including bug bounty reports), distinguishing true positives and coordinating remediation Contribute to threat modeling and security design reviews for the detection, logging, and incident-response implications of new systems Apply strong AWS and Kubernetes judgment to secure the systems you operate and advise owning teams on remediation Support and implement security controls aligned with PCI DSS, SOC 2, and other compliance requirements — with your logging and detection work producing the audit evidence as a by-product Develop and implement automation (including AI) to improve efficiency in security operations, detection, and response Participate in the on-call rotation for detection and response and the services you own What We Look For: 6+ years of experience in security, software, or infrastructure engineering, with hands-on experience securing cloud-based production systems and working with real-world security challenges Experience working with SIEM platforms (e.g., Wazuh, Splunk, ELK) for detection engineering, monitoring, and incident response Experience designing and tuning detection rules, reducing alert noise, and improving investigation workflows Strong hands-on experience in vulnerability management — scanning, triage and validation of scanner and bug-bounty findings, remediation coordination, and verification Strong knowledge of AWS, Linux, and Kubernetes infrastructure, including security architecture and operational best practices Ability to investigate issues directly using logs, cloud tooling, and system-level data Experience assessing the detection and logging implications of new systems in design reviews Knowledge of common security vulnerabilities and mitigation strategies (OWASP, SANS, etc.) Working knowledge of compliance frameworks such as PCI DSS and SOC 2, particularly logging, monitoring, and evidence expectations Demonstrated AI-forward engineering: you actively use AI tooling (e.g., Claude Code, Codex, Cursor, or custom LLM integrations) in your work today, and have opinions grounded in practice about where it helps and where it doesn't Preferred Knowledge and Skills: You have built AI-assisted workflows that others adopted — triage, enrichment, or hunting Familiarity with log-based detection, telemetry pipelines, and security analytics use cases Experience with internal penetration testing or adversarial exercises, and translating results into detection and remediation work Strong understanding of cloud-native security controls, including IAM, network segmentation, and container security Experience with container and dependency security tools (e.g., Snyk, Trivy, Grype) as an operator of their findings Experience aligning technical security work with regulatory and compliance expectations Experience in fintech, payments, or other regulated environments About You: You think like an investigator - you turn telemetry into detections and detections into answers, and you are not done until the root cause is fixed. You treat attribution as an engineering deliverable - every access to sensitive data has a name on it, and every finding has an owner and a date. You are excited to use automation and emerging technologies (including AI) to take repetitive security work off the team's plate You balance strong security standards with business needs and can support privacy and compliance requirements in a practical, scalable way You have relentlessly high standards - many people may think your standards are unreasonably high. You are continually raising the bar and driving those around you to deliver great results. You make sure that defects do not get sent down the line and that problems are fixed so they stay fixed. You’re not bound by convention - your success—and much of the fun—lies in developing new ways to do things You need action - speed matters in business. Many decisions and actions are reversible and do not need extensive study. We value calculated risk-taking. You earn trust - you listen attentively, speak candidly, and treat others respectfully. You have backbone; disagree, then commit - you can respectfully challenge decisions when you disagree, even when doing so is uncomfortable or exhausting. You have conviction and are tenacious. You do not compromise for the sake of social cohesion. Once a decision is determined, you commit wholly. You deliver results - you focus on the key inputs and deliver them with the right quality and in a timely fashion. Despite setbacks, you rise to the occasion and never settle. Sezzle’s Technology Stack: Languages: Golang, Typescript, Python Frontend: Typescript - React and React Native Backend: Golang Database: MySQL, Postgres, Elasticsearch DevOps & Cloud: AWS, Kubernetes Version Control: Git CI/CD: Gitlab Testing: Developer and AI-driven, focus on automated end-to-end, integration, and unit tests Open Source: Sezzle is focused on using open source, and we build what we can before buying! What Makes Working at Sezzle Awesome? At Sezzle, we are more than just brilliant engineers, passionate data enthusiasts, out-of-the-box thinkers, and determined innovators; we are skilled musicians, yogis, cyclists, chefs, golfers, dog-lovers, and rock-climbers. We believe in surrounding ourselves with not only the best and the brightest individuals, but those that are unique and purpose-driven in all that they do. Our culture is not defined by a certain set of perks designed to give the illusion of the traditional startup culture, but rather, it is the visible example living in every employee that we hire. #Li-remote #Full-time

Requirements

Must-haves

Build, operate, and mature SIEM/XDR capabilities, including log ingestion, detection rule development, alert tuning, and investigation workflows
Design and implement detection strategies for suspicious activity, including data exfiltration patterns using application and database telemetry
Investigate and respond to security incidents across cloud infrastructure and applications, performing root cause analysis and driving long-term fixes
Run proactive threat hunts across cloud and identity planes, building agentic hunting workflows that make hunts repeatable
Triage and validate external security findings (including bug bounty reports), distinguishing true positives and coordinating remediation
Contribute to threat modeling and security design reviews for the detection, logging, and incident-response implications of new systems
Apply strong AWS and Kubernetes judgment to secure the systems you operate and advise owning teams on remediation
Support and implement security controls aligned with PCI DSS, SOC 2, and other compliance requirements — with your logging and detection work producing the audit evidence as a by-product
Develop and implement automation (including AI) to improve efficiency in security operations, detection, and response
Participate in the on-call rotation for detection and response and the services you own
6+ years of experience in security, software, or infrastructure engineering, with hands-on experience securing cloud-based production systems and working with real-world security challenges
Experience working with SIEM platforms (e.g., Wazuh, Splunk, ELK) for detection engineering, monitoring, and incident response
Experience designing and tuning detection rules, reducing alert noise, and improving investigation workflows
Strong hands-on experience in vulnerability management — scanning, triage and validation of scanner and bug-bounty findings, remediation coordination, and verification
Strong knowledge of AWS, Linux, and Kubernetes infrastructure, including security architecture and operational best practices
Ability to investigate issues directly using logs, cloud tooling, and system-level data
Experience assessing the detection and logging implications of new systems in design reviews
Knowledge of common security vulnerabilities and mitigation strategies (OWASP, SANS, etc.)
Working knowledge of compliance frameworks such as PCI DSS and SOC 2, particularly logging, monitoring, and evidence expectations
You have built AI-assisted workflows that others adopted — triage, enrichment, or hunting
Familiarity with log-based detection, telemetry pipelines, and security analytics use cases
Experience with internal penetration testing or adversarial exercises, and translating results into detection and remediation work
Strong understanding of cloud-native security controls, including IAM, network segmentation, and container security
Experience with container and dependency security tools (e.g., Snyk, Trivy, Grype) as an operator of their findings

Nice-to-haves

None flagged.

Application prep

Use the role’s language and application details while tailoring your materials.

Keywords to mirror

aikubernetesawsllmgolangtypescriptpythonreactpostgresci/cd

Platform: greenhouse
Effort: quick