Senior Cybersecurity Engineer (Infrastructure)

About the role:

The cybersecurity team at FYUL is deliberately small and execution-focused. Its engineering branch runs the company's security operations backbone: a large-scale telemetry and detection platform covering endpoints, network traffic, cloud workloads, and SaaS — a modern SIEM at its core, extended with substantial custom machine learning and AI agents that this team designs and builds itself. This senior engineer role, reporting directly to the Information Security Engineering Manager, owns significant parts of that platform: detection engineering, vulnerability discovery, cloud and endpoint security, data loss prevention, and the automation of security operations.

This is an individual-contributor position where professional growth comes from depth of expertise and ownership of outcomes. The security program is mature, with governance and compliance handled by a dedicated GRC function — so this role is about building and running security engineering, full-time.

Your daily tasks will include:

• Detection engineering. Design, implement, and tune detections across our security telemetry — SIEM rules as well as custom ML models for anomaly and risk detection. Triage alerts, investigate real incidents, and drive them to closure — including technical incident response and post-incident improvement.

• Cloud and platform security. Harden and monitor our AWS and Kubernetes (EKS) environments: workload security, IAM, container runtime defense, and configuration standards. Collaborate with engineering teams so security lands as enablement, not friction.

• Endpoint security. Own the health and hardening of the endpoint agent fleet across macOS, Windows, and Linux.

• Data loss prevention. Operate and extend DLP coverage across removable media, email, and SaaS channels: telemetry-driven detection of data exfiltration, tuned to keep false positives low.

• Security automation. Automate recurring operations and detection-to-response workflows — including AI-based agents and pipelines, which are already a working part of this program. Prefer integrating established tooling over bespoke development where it delivers the same outcome.

• Vulnerability discovery and management. Find infrastructure vulnerabilities yourself — through scanning, configuration review, and targeted penetration testing of our environments — then prioritize and drive remediation to closure. This is not an application security role: a dedicated sub-team covers appsec.

Your qualifications:

• 5+ years in security engineering or SecOps roles with hands-on responsibility for detections and incidents in production — not solely policy or advisory work.

• Real detection engineering experience on a modern SIEM/security platform (Elastic Security preferred; Splunk, Sentinel, or comparable count), and the appetite to go beyond built-in rules into custom ML-based detection.

• Deep, hands-on mastery of Linux, macOS, and Windows: internals, hardening, and investigation on all three. You have personally hunted or hardened systems on each of them, not just one favorite.

• Strong networking expertise: TCP/IP, routing, VPNs, firewalls, and packet-level analysis — you can reconstruct what happened from a packet capture and reason about how traffic actually flows through our environments.

• Strong cloud security foundation in AWS, including Kubernetes; you have personally secured and monitored production cloud workloads.

• Hands-on LLM experience. You have built or operated LLM-powered tooling — agents, pipelines, or detection/automation workflows — not merely used a chat assistant. Our security program already runs AI agents in production; you will extend that work.

• A certification in practical infrastructure hacking or hardening — e.g., OSCP, OSEP, or a comparable hands-on offensive credential. This matters more to us than knowledge-exam certifications.

• Demonstrated automation capability: scripts, integrations, pipelines, or AI-assisted workflows you can show. Software engineering background is not required; a track record of building practical automation is.

• Self-directed working style with strong ownership: the ability to take ambiguous problems through to completed outcomes with minimal supervision.

• Excellent written and spoken English.

• Further certifications (e.g., CISSP, GIAC/GCFA/GCIH, AWS Security) are an advantage, but the hands-on hacking/hardening credential above is the one we screen for. Hands-on experience always outweighs certification.

Our tech stack:

• Infra: AWS, Kubernetes, Terraform, Helm, Atlantis

• Engineering Tools: Postman, Git, GitHub Copilot, PhpStorm, Grafana, Kibana, Prometheus

• Remote work Tools: Jira, Miro, Google Workspace, Slack.

• Development Practices: Pair Programming, Code Reviews, Continuous Integration/Deployment.

What we offer:

• Monthly salary EUR €4,000 - €6,000/month gross, depending on work experience, education, and skills

• A global, inclusive team that’s as supportive as it is ambitious and serious about getting things done

• An opportunity to work remotely or in a modern and welcoming office in Riga

• Flexible working hours (start your day as late as 11 AM)

• Private health insurance

• 2 extra paid days off to focus on your mental or physical well-being

• 1 extra paid day off to celebrate a Birthday or any other celebration of your choice

• Internal and external learning opportunities

• Access to mentorship, internal meetups, and hackathons, both on-site and online

• Free and healthy lunch if you work from the Rīga office

• Design and order your own merch using our platforms with an employee discount

• Exciting team-building events and parties you’ll never forget!