Detection and Response Engineer at Moniepoint Incorporated – Remote, Nigeria

Moniepoint Incorporated is recruiting a Detection and Response Engineer for a remote role in Nigeria, covering incident investigations, detection engineering and response automation.

The role

Joining the Incident Response team, the engineer will move beyond first-line triage to own investigations and improve detection coverage. Working with the Lead, the role aims to reduce detection and response times and build deeper detection engineering and incident-response ownership.

Investigations and threat analysis

• Own escalated incidents from scoping and evidence collection through threat analysis, containment and remediation, and review reported incidents.
• Analyse and reverse-engineer malware to identify behaviour, indicators of compromise, tactics, techniques and procedures and suitable responses.
• Hunt for threats using detection content, intelligence and independent hypotheses, and turn intelligence and investigation findings into new detection opportunities.

Detection and automation

• Write, test, deploy and document detection rules through the CI/CD Detection-as-Code pipeline using YARA-L or equivalent languages.
• Tune detections to reduce false positives and propose new rules to close gaps exposed by incidents and threat hunting.
• Build and maintain SOAR playbooks and security automation, including AI-driven and agentic workflows for alert triage, enrichment and faster response.
• Participate in tabletop, purple-team and threat-intelligence simulations, execute scenarios and translate findings into stronger detection content.
• Coordinate log-source onboarding and ingestion health across enterprise applications and cloud environments, identify visibility gaps and arrange remediation.
• Lead threat modelling for critical infrastructure and develop high-fidelity detections, hunting hypotheses and automated event-enrichment pipelines.

Collaboration and standards

• Work with cloud security, infrastructure and development teams to address systemic issues.
• Maintain investigation records, rule-change documentation, intelligence records and playbooks to support peer review and audit.
• Align practices with PCI-DSS, ISO 27001 and NIST CSF 2.0, and improve processes as threats and security practices develop.

Qualifications

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology or a related field, or equivalent hands-on experience.
• Two to four years in incident response, SOC operations or detection engineering.
• Experience writing or tuning SIEM rules, including Google SecOps or similar, using YARA-L, CQL, KQL, Sigma or an equivalent language.
• Practical SIEM and EDR skills, log analysis and end-to-end incident investigation, plus knowledge of MITRE ATT&CK and detection coverage.
• Python, JavaScript or similar scripting skills for automation and clear written incident and detection documentation.

Preferred experience and certifications

• SOAR platforms or triage and enrichment automation; exposure to GCP, AWS and financial-sector threats.
• Foundational digital forensics or malware analysis, and GCIH, CySA+ or equivalent incident-response/detection certifications.

Benefits and development

• Mentorship from a Lead responsible for the detection-as-code and automation stack and a path towards senior detection engineering and incident-response ownership.
• Fintech security work, learning and development, knowledge-sharing sessions and internal technical talks.
• An environment that values employees’ wellbeing and contributions, alongside salary, pension, health insurance, annual bonus and other benefits.

Hiring process

• An initial recruiter phone call.
• A technical interview with a Team Lead.
• A behavioural and technical interview with an Executive team member.