Senior Cybersecurity Engineer (Infrastructure)

FYUL•Capon Bridge, WV

6d•€4,000 - €6,000

About The Position

FYUL is seeking a Senior Cybersecurity Engineer for its small, execution-focused cybersecurity team. The engineering branch operates the company’s security operations backbone: a large-scale telemetry and detection platform covering endpoints, network traffic, cloud workloads, and SaaS. The platform is built around a modern SIEM and extended with custom machine-learning systems and AI agents designed and developed by the team. Reporting directly to the Information Security Engineering Manager, this individual contributor will own significant parts of the platform, including detection engineering, vulnerability discovery, cloud and endpoint security, data loss prevention, and security-operations automation. The security program is mature, with governance and compliance managed by a dedicated GRC function, leaving this role focused on building and operating security engineering. The role includes designing and tuning SIEM detections and custom ML models; investigating and responding to incidents through resolution and post-incident improvement; securing AWS and Kubernetes (EKS) environments; maintaining endpoint security across macOS, Windows, and Linux; operating and extending DLP coverage; automating operational and detection-to-response workflows, including AI-based agents and pipelines; and identifying infrastructure vulnerabilities through scanning, configuration reviews, and targeted penetration testing. Application security is covered by a dedicated sub-team. The position offers a monthly gross salary of €4,000–€6,000, depending on experience, education, and skills. Employees may work remotely or from a modern office in Riga, with flexible working hours and a start time as late as 11 AM. The company describes itself as a global, inclusive, fast-growing team and offers learning opportunities, mentorship, internal meetups and hackathons, office lunch, employee-discounted merchandise, and team events.

Requirements

At least 5 years of experience in security engineering or SecOps, with hands-on production responsibility for detections and incidents; policy- or advisory-only experience does not qualify.
Practical detection-engineering experience with a modern SIEM or security platform. Elastic Security is preferred; Splunk, Sentinel, or comparable platforms are acceptable.
Deep, hands-on knowledge of Linux, macOS, and Windows internals, hardening, and investigation, with direct experience hunting or hardening systems on all three.
Strong networking expertise, including TCP/IP, routing, VPNs, firewalls, and packet-level analysis; ability to reconstruct events from packet captures and reason about traffic flows.
Strong AWS cloud-security foundation, including hands-on experience securing and monitoring production cloud workloads and Kubernetes.
Hands-on experience building or operating LLM-powered tools, such as agents, pipelines, or detection and automation workflows.
A practical infrastructure hacking or hardening certification, such as OSCP, OSEP, or a comparable hands-on offensive credential.
Demonstrated ability to build practical automation, such as scripts, integrations, pipelines, or AI-assisted workflows.
Self-directed working style and strong ownership, including the ability to take ambiguous problems through to completion with minimal supervision.
Excellent written and spoken English.

Nice To Haves

Elastic Security experience is preferred.
Further certifications, such as CISSP, GIAC/GCFA/GCIH, or AWS Security, are advantageous.
Hands-on experience is valued more highly than certifications; the practical infrastructure hacking or hardening credential is the certification specifically screened for.

Responsibilities

Design, implement, and tune detections across security telemetry, including SIEM rules and custom machine-learning models for anomaly and risk detection.
Triage alerts, investigate real incidents, lead technical incident response through closure, and drive post-incident improvements.
Harden and monitor AWS and Kubernetes (EKS) environments, including workload security, IAM, container runtime defense, and configuration standards.
Collaborate with engineering teams to integrate security in an enabling, low-friction way.
Own the health and hardening of endpoint agents across macOS, Windows, and Linux.
Operate and extend data loss prevention coverage across removable media, email, and SaaS channels, using telemetry to detect data exfiltration while limiting false positives.
Automate recurring security operations and detection-to-response workflows, including AI-based agents and pipelines; prefer established tooling over bespoke development when it achieves the same outcome.
Discover infrastructure vulnerabilities through scanning, configuration review, and targeted penetration testing; prioritize findings and drive remediation to completion.