Senior SOC Engineer

The Impact You’ll Drive
Vegapay is looking for an experienced security operations professional to build our Security Operations Center from the ground up. As a fintech infrastructure provider processing sensitive financial data on behalf of banks and NBFCs, continuous threat detection, rapid incident response, and defensible monitoring are foundational to the trust our regulated BFSI partners place in us. This is a founding role — you will be the first and only member of the SOC on day one, responsible end-to-end for designing the function, selecting and deploying tooling, running day-to-day operations, and ultimately scaling the team. You will operate independently from day one, while partnering closely with Security, Engineering, GRC, Legal, and leadership to protect Vegapay’s platform, customers, and partners from active threats.
The Hats You Will Wear
SOC Build-Out & Strategy
Define and execute the operating roadmap for Vegapay’s Security Operations Center — processes, playbooks, use cases, detection coverage, and metrics
Take ownership of the SOC technology stack (SIEM, SOAR, EDR, log pipeline, threat intel platform) being stood up in parallel — configure, integrate, tune, and operationalize it end-to-end once onboarded
Establish operating cadence, coverage model, and escalation paths; design the hiring plan to scale the function beyond this founding role
Threat Detection & Monitoring
Build and tune detection content across cloud (AWS/GCP), endpoint, identity, network, and application layers
Establish monitoring coverage during the build-out — directly during business hours and via tooling and MSSP partnerships off-hours — and transition to an in-house follow-the-sun model as the team grows
Define and track SOC KPIs including MTTD, MTTR, false-positive rate, and detection coverage mapped to MITRE ATT&CK
Incident Response
Own end-to-end incident response — triage, containment, eradication, recovery, and post-incident review — for all security events
Author and maintain the incident response plan, runbooks, severity matrix, and tabletop exercise program
Serve as incident commander during security incidents and coordinate response with Engineering, Legal, GRC, and leadership
Threat Intelligence & Hunting
Operationalize threat intelligence relevant to fintech, payments, and BFSI threat actors; convert intel into detections and preventative controls
Conduct proactive, hypothesis-driven threat hunts across the environment and document findings into reusable detections
Track emerging TTPs targeting the payments ecosystem and brief Security and Engineering leadership on evolving risks
Vulnerability & Attack Surface Management
Operate vulnerability management across cloud workloads, endpoints, and applications; drive remediation with engineering owners against defined SLAs
Monitor the external attack surface and triage findings from bug bounty, penetration tests, and red team exercises
Security Tooling & Automation
Build automation to reduce manual toil — alert enrichment, response actions, evidence collection, and reporting
Integrate SOC tooling with the broader security and engineering stack (ticketing, chatops, CI/CD, cloud control planes, identity providers)
Cross-Functional Collaboration & Reporting
Partner with GRC to supply evidence of monitoring, detection, and response controls for ISO 27001, SOC 2, PCI-DSS, and RBI audits
Support client and auditor queries on security operations, monitoring coverage, and incident response readiness
Prepare SOC dashboards, incident reports, and leadership/board updates on the threat and detection landscape
The Perfect Fit
Bachelor’s degree in Engineering, Technology, Computer Science, or a related field
6–8 years of hands-on experience in security operations, incident response, threat detection, or threat hunting — preferably within fintech, BFSI, SaaS, or payments
Deep expertise with SIEM platforms (Splunk, Elastic, Sentinel, Chronicle, or equivalent) including detection engineering and content tuning
Strong experience leading end-to-end incident response in cloud-native environments (AWS and/or GCP)
Working knowledge of EDR, SOAR, and threat intelligence platforms, with the ability to select and deploy tooling in a greenfield environment
Practical understanding of attacker TTPs (MITRE ATT&CK), common cloud attack paths, and payment-ecosystem threat scenarios
Demonstrated ability to work independently as a sole contributor — scoping, prioritizing, and delivering without a surrounding team
Excellent written and verbal communication skills, including incident reporting and executive-level updates
Your Edge Over the Rest
Professional certifications such as GCIH, GCIA, GCFA, GNFA, GCDA, OSCP, CISSP, or equivalent
Prior experience building or scaling a SOC function from the ground up, including vendor selection and MSSP management
Experience with detection-as-code, SOAR playbook development, and infrastructure-as-code for security tooling
Exposure to RBI, PCI-DSS, SOC 2, and ISO 27001 control requirements that touch monitoring and incident response
Familiarity with digital forensics, malware analysis, and threat intelligence tradecraft
The Problem We’re Solving
Financial institutions today are held back by legacy systems that are slow, rigid, and expensive to scale. Launching or evolving credit, lending, and UPI products often takes months, requires heavy engineering effort, and limits the ability to create personalized customer experiences.
At the same time, customer expectations have changed - speed, flexibility, and tailored financial products are no longer optional. Banks and fintechs need infrastructure that allows them to innovate quickly, adapt continuously, and scale without friction.
This is where we come in.
At Vegapay, we are building modern, configurable fintech infrastructure that enables banks, NBFCs, and enterprises to design, launch, and manage credit and payment programs with ease. Our platform brings together flexibility, speed, and control - helping our partners unlock new growth opportunities and deliver personalized banking experiences at scale.
The Opportunity Ahead
Lead and shape high-impact engineering teams building real-world fintech infrastructure
Drive both technical direction and team growth - with real ownership and decision-making authority
Work on complex, scalable systems that directly power banking, credit, and payments
Collaborate with strong product and leadership teams in a fast-moving, execution-first environment