SIEM Detection Engineer in London

Zama is an open-source cryptography company building state-of-the-art FHE solutions for blockchain. Zama’s Fully Homomorphic Encryption protocol is a cryptography milestone. By enabling efficient, developer-friendly FHE, Zama unlocks secure, compliant, and verifiable dApps for AI, crypto, and cloud. We believe people shouldn’t have to care about privacy—not because privacy doesn’t matter, but because it shouldn’t be an issue. We are a remote-friendly company with headquarters in the centre of Paris.

Our Security team is on the lookout for an experienced and versatile SIEM Detection Engineer to help us catch threats earlier and respond to them faster. As the engineer dedicated to our web2 monitoring and alerting, you’ll shape the next chapter of detection and response at Zama. Alongside the rest of the Security team, you’ll be a frontline defender and help architect the foundations of our defence strategy.

You will:

• Spearhead the move from the SIEM that got our monitoring off the ground to a more mature platform: evaluate options, drive the migration, and design for longer data retention and stronger monitoring and alerting.
• Integrate log sources across cloud, identity, endpoint, SaaS, network, and application systems to ensure comprehensive, reliable visibility.
• Develop, tune, and maintain detection rules, alerts, and dashboards, and proactively hunt for threats and anomalies hiding in our logs.
• Build the tooling, queries, and automation (AI-assisted where it helps) that speed up evidence collection, triage, and response while stripping out recurring manual work.
• Serve on the on-call rotation as a first responder, investigating alerts, reconstructing timelines, preserving evidence, and driving containment and remediation with system owners while balancing urgency with business impact.
• Take command of complex incidents when they arise, keeping priorities, decisions, and handoffs clear across teams and time zones, then lead the post-incident reviews that turn lessons into lasting improvements.
• Collaborate closely with infrastructure and engineering teams to close telemetry gaps, and help shape our security policies, procedures, and documentation.
• Stay abreast of emerging threats, vulnerabilities, and attacker techniques, especially those targeting the crypto ecosystem, to keep Zama one step ahead.

Key Requirements:

• 6+ years of hands-on experience across threat hunting, SIEM management, incident response, and digital forensics, including commanding incidents that span multiple teams and competing priorities.
• Experience building detection content for multiple SIEM platforms; having led a SIEM migration is a big plus.
• Strong knowledge of attacker behaviour, real-world experience applying anomaly detection techniques, and depth in several areas across identity, endpoint, cloud, network, or application security.
• Solid SQL and log-analysis skills and proficiency in Python, with a track record of building reliable tools and making sense of large, messy datasets.
• An established AI-assisted workflow, plus experience building AI-based systems that improve incident coordination and case management.
• A pragmatic builder’s mindset: you pick up new technologies fast, love digging into the details, and make sure every incident leaves our defenses stronger.
• Exceptional communication skills in English (C1 level; French is a plus) and sound judgment when working with engineers, executives, and sensitive information.
• Bonus points for crypto or blockchain security experience, infrastructure automation with tools like Terraform/Terragrunt, or an offensive security background (red teaming, pen testing, OSCP).

Exceptional candidates will hear from us as we advance through the recruitment process. Zama values and promotes diversity. We give everyone a fair chance to be evaluated on their professional, academic, and personal skills. Our goal is to make the hiring process as pleasant, stress-free, and friendly as possible, even if it is longer and more involved than you might find elsewhere.