Senior Security Engineer at Repay Holdings

Job description

ABOUT REPAY REPAY (“Realtime Electronic Payments” / NASDAQ TICKER: RPAY) is an established and fast-growing publicly traded financial technology and payment processing company headquartered in Atlanta, Georgia, with offices across the country. REPAY enables its customers to accept payments anytime, anywhere, and through any channel while providing a secure, seamless, and enjoyable payment experience for the end consumers. REPAY offers a comprehensive suite of electronic payment and funding solutions, including debit and credit card processing, ACH processing, Instant Funding, and electronic bill payment systems with full IVR, text, and mobile capabilities. The scalability of its products allows merchants of all sizes to add an instant arsenal of intelligent payment technology solutions to their businesses without significant development costs or infrastructure investments. ABOUT THE ROLE REPAY is seeking a highly motivated, self-driven Senior Security Engineer to join our Security Operations team. This role sits at the center of our Security Operations Center (SOC) — monitoring and triaging security event queues, conducting proactive threat hunting, and driving incidents from detection through containment and remediation. You will partially own and continuously improve our response playbooks and procedures, build and maintain the automation and integrations that reduce repetitive operational work, operationalize new detections, and assist with vulnerability management as needed. You will also use and train our agentic SOC platform, applying AI-driven workflows to improve triage quality and reduce time to detect and respond. This role participates in the 24/7 weekly on call rotation and partners closely with IT, cloud engineering, network, and application teams to coordinate response actions and remediations. The ideal candidate is a curious, hands-on investigator who is comfortable making decisions under pressure, communicates clearly during active incidents, and turns every incident into a lasting improvement. RESPONSIBILITIES Security Monitoring and Triage Monitor and triage security event and alert queues across SIEM, EDR/XDR, identity, email, cloud, and network telemetry, ensuring timely and accurate disposition. Investigate alerts to determine scope, impact, and root cause, escalating confirmed incidents according to defined severity criteria. Participate in the 24/7 weekly Security Operations on call rotation, providing timely response to high priority security alerts, incidents, and escalations. Document investigative findings, decisions, and evidence to a standard that supports audit, legal, and post-incident review needs. Threat Hunting Conduct proactive, hypothesis-driven threat hunts across endpoint, network, cloud, identity, and SaaS environments. Leverage threat intelligence, MITRE ATT&CK, and adversary tradecraft to surface activity that evades existing detections. Produce hunt reports covering findings, detection gaps, and recommended improvements. Incident Response, Playbooks, and Procedures Execute incident response activities including triage, investigation, containment, eradication, and recovery. Own the development, maintenance, and testing of response playbooks, runbooks, and standard operating procedures. Lead or contribute to post-incident reviews, tracking corrective actions to closure and updating playbooks based on lessons learned. Support tabletop exercises and purple team activities to validate detection and response readiness. Response Actions Using Security Tooling Take containment and remediation actions using enterprise security tooling, including EDR/XDR host isolation and response, SASE/SSE policy enforcement, secure email gateway (SEG) and DLP rule tuning. Request, review, and implement firewall and network access rule changes to block malicious activity and reduce exposure. Agentic SOC Enablement Use the agentic SOC platform in daily operations to accelerate alert triage, enrichment, and inv