The posting
The Impact You’ll Drive
Vegapay is looking for an experienced security operations professional to build our Security Operations Center from the ground up. As a fintech infrastructure provider processing sensitive financial data on behalf of banks and NBFCs, continuous threat detection, rapid incident response, and defensible monitoring are foundational to the trust our regulated BFSI partners place in us. This is a founding role — you will be the first and only member of the SOC on day one, responsible end-to-end for designing the function, selecting and deploying tooling, running day-to-day operations, and ultimately scaling the team. You will operate independently from day one, while partnering closely with Security, Engineering, GRC, Legal, and leadership to protect Vegapay’s platform, customers, and partners from active threats.
The Hats You Will Wear
SOC Build-Out & Strategy
- Define and execute the operating roadmap for Vegapay’s Security Operations Center — processes, playbooks, use cases, detection coverage, and metrics
- Take ownership of the SOC technology stack (SIEM, SOAR, EDR, log pipeline, threat intel platform) being stood up in parallel — configure, integrate, tune, and operationalize it end-to-end once onboarded
- Establish operating cadence, coverage model, and escalation paths; design the hiring plan to scale the function beyond this founding role
Threat Detection & Monitoring
- Build and tune detection content across cloud (AWS/GCP), endpoint, identity, network, and application layers
- Establish monitoring coverage during the build-out — directly during business hours and via tooling and MSSP partnerships off-hours — and transition to an in-house follow-the-sun model as the team grows
- Define and track SOC KPIs including MTTD, MTTR, false-positive rate, and detection coverage mapped to MITRE ATT&CK
Incident Response
- Own end-to-end incident response — triage, containment, eradication, recovery, and post-incident review — for all security events
- Author and maintain the incident response plan, runbooks, severity matrix, and tabletop exercise program
- Serve as incident commander during security incidents and coordinate response with Engineering, Legal, GRC, and leadership
Threat Intelligence & Hunting
- Operationalize threat intelligence relevant to fintech, payments, and BFSI threat actors; convert intel into detections and preventative controls
- Conduct proactive, hypothesis-driven threat hunts across the environment and document findings into reusable detections
- Track emerging TTPs targeting the payments ecosystem and brief Security and Engineering leadership on evolving risks
Vulnerability & Attack Surface Management
- Operate vulnerability management across cloud workloads, endpoints, and applications; drive remediation with engineering owners against defined SLAs
- Monitor the external attack surface and triage findings from bug bounty, penetration tests, and red team exercises
Security Tooling & Automation
- Build automation to reduce manual toil — alert enrichment, response actions, evidence collection, and reporting
- Integrate SOC tooling with the broader security and engineering stack (ticketing, chatops, CI/CD, cloud control planes, identity providers)
Cross-Functional Collaboration & Reporting
- Partner with GRC to supply evidence of monitoring, detection, and response controls for ISO 27001, SOC 2, PCI-DSS, and RBI audits
- Support client and auditor queries on security operations, monitoring coverage, and incident response readiness
- Prepare SOC dashboards, incident reports, and leadership/board updates on the threat and detection landscape
The Perfect Fit
- Bachelor’s degree in Engineering, Technology, Computer Science, or a related field
- 6–8 years of hands-on experience in security operations, incident response, threat detection, or threat hunting — preferably within fintech, BFSI, SaaS, or payments
- Deep expertise with SIEM platforms (Splunk, Elastic, Sentinel, Chronicle, or equivalent) including detection engineering and content tuning
- Strong experience leading end-to-end incident response in cloud-native environments (AWS and/or GCP)
- Working knowledge of EDR, SOAR, and threat intelligence platforms, with the ability to select and deploy tooling in a greenfield environment
- Practical understanding of attacker TTPs (MITRE ATT&CK), common cloud attack paths, and payment-ecosystem threat scenarios
- Demonstrated ability to work independently as a sole contributor — scoping, prioritizing, and delivering without a surrounding team
- Excellent written and verbal communication skills, including incident reporting and executive-level updates
Your Edge Over the Rest
- Professional certifications such as GCIH, GCIA, GCFA, GNFA, GCDA, OSCP, CISSP, or equivalent
- Prior experience building or scaling a SOC function from the ground up, including vendor selection and MSSP management
- Experience with detection-as-code, SOAR playbook development, and infrastructure-as-code for security tooling
- Exposure to RBI, PCI-DSS, SOC 2, and ISO 27001 control requirements that touch monitoring and incident response
- Familiarity with digital forensics, malware analysis, and threat intelligence tradecraft
The Problem We’re Solving
Financial institutions today are held back by legacy systems that are slow, rigid, and expensive to scale. Launching or evolving credit, lending, and UPI products often takes months, requires heavy engineering effort, and limits the ability to create personalized customer experiences.
At the same time, customer expectations have changed - speed, flexibility, and tailored financial products are no longer optional. Banks and fintechs need infrastructure that allows them to innovate quickly, adapt continuously, and scale without friction.
This is where we come in.
At Vegapay, we are building modern, configurable fintech infrastructure that enables banks, NBFCs, and enterprises to design, launch, and manage credit and payment programs with ease. Our platform brings together flexibility, speed, and control - helping our partners unlock new growth opportunities and deliver personalized banking experiences at scale.
The Opportunity Ahead
- Lead and shape high-impact engineering teams building real-world fintech infrastructure
- Drive both technical direction and team growth - with real ownership and decision-making authority
- Work on complex, scalable systems that directly power banking, credit, and payments
- Collaborate with strong product and leadership teams in a fast-moving, execution-first environment
