At least 5 years of experience in security operations, incident response, threat hunting, or a closely related cybersecurity function.
Experience managing outsourced security operations center providers, including setting expectations, overseeing performance, and ensuring effective monitoring and incident response.
Ability to build and scale security operations teams, including defining processes, roles, workflows, and operating procedures.
Hands-on experience with security information and event management platforms such as Splunk, Microsoft Sentinel, or Elastic, including developing, tuning, and maintaining detection content.
Expertise with endpoint detection and response solutions and endpoint forensics, including investigating and responding to sophisticated endpoint threats.
Understanding of attacker techniques and tradecraft, including practical application of the MITRE ATT&CK framework.
Technical foundation in networking, Windows and Linux operating systems, authentication, and identity management.
Scripting and automation skills using Python, PowerShell, or similar languages to support security analysis, investigation, and operational efficiency.
Ability to explain security incidents and technical risks clearly to engineering teams and executive stakeholders.
Judgment and decision-making skills when operating under pressure, during active incidents, and with incomplete or ambiguous information.
Responsibilities
Lead investigations and response for high-severity security incidents from initial detection through containment, eradication, recovery, and post-incident review.
Design, tune, and maintain detection logic across security information and event management, endpoint detection and response, and cloud security tools; retire rules that generate noise instead of useful signals.
Conduct proactive threat hunts based on threat intelligence, adversary tactics, techniques, and procedures, and anomalies in telemetry.
Perform forensic analysis of endpoints, network traffic, and cloud environments to determine scope and root cause.
Write and maintain runbooks, playbooks, and post-incident reports to improve response speed.
Partner with engineering and information technology teams to address gaps identified through incidents and hunts, and improve logging and telemetry coverage.
Automate repetitive response steps through security orchestration, automation, and response workflows or scripting.
Mentor junior analysts on investigation methodology, tooling, and escalation judgment.
Contribute to tabletop exercises, purple-team engagements, and control validation.
Support audit and compliance evidence requests related to security monitoring and incident response.
Build KOMOJU’s security operations capability and continuously improve detection, response, and automation.
Improve detection coverage, reduce false positives, accelerate incident response, and build an audit-ready security operations model.
Take end-to-end ownership of security incidents, make timely and proportionate decisions under pressure, and follow through to resolution.
Protect sensitive payment and personal data, strengthening merchant confidence and service reliability.
Partner with Engineering, site reliability engineering, information technology, Compliance, and external security operations center providers while sharing knowledge to improve organizational security capability.
Desired Qualifications
Experience securing cloud environments such as AWS, Google Cloud Platform, or Azure, including cloud-native logging and detection.
Familiarity with container and Kubernetes security.
Experience with security orchestration, automation, and response platforms and detection-as-code workflows.
Malware analysis or reverse engineering experience.
Certifications such as GCIA, GCIH, GCFA, OSCP, or CISSP, or equivalent practical experience.
Exposure to compliance frameworks relevant to the business, including SOC 2, ISO 27001, PCI DSS, or HIPAA.
About KOMOJU
KOMOJU is the leading cross-border payment gateway for Japan. We power payments for companies like video game distribution platform Steam and the popular mobile app TikTok. Today we help thousands of merchants by providing them with the payment infrastructure they need through developer-friendly API’s to integrations on popular platforms like Shopify and Wix; we help our merchants grow in all markets they are expanding.
About the position
We are a payment processor that handles very sensitive data for both our merchants and their customers. As we grow we need to make sure that our security is excellent and that our customer’s data is secure.
We are seeking a skilled and motivated Senior Security Analyst to serve as a technical anchor of our security operations team. You'll lead investigations into complex threats, build the detections that catch them earlier next time, and raise the bar for how the whole team responds to incidents.
This is a hands-on role for someone who has outgrown pure alert triage and wants ownership: of detection quality, of incident outcomes, and of mentoring the analysts around you.
What you'll do
Lead investigation and response for high-severity security incidents, from initial detection through containment, eradication, recovery, and post-incident review.
Design, tune, and maintain detection logic across our SIEM, EDR, and cloud security tooling, and retire the rules that generate noise instead of signal.
Conduct proactive threat hunts based on threat intelligence, adversary TTPs, and anomalies in telemetry.
Perform forensic analysis of endpoints, network traffic, and cloud environments to determine scope and root cause.
Write and maintain runbooks, playbooks, and post-incident reports that make the next response faster.
Partner with engineering and IT teams to close gaps surfaced by incidents and hunts, and to improve logging and telemetry coverage.
Automate repetitive response steps through SOAR (Security Orchestration, Automation, and Response) workflows or scripting.
Mentor junior analysts on investigation methodology, tooling, and escalation judgment.
Contribute to tabletop exercises, purple team engagements, and control validation.
Support audit and compliance evidence requests as they relate to security monitoring and incident response.
What we're looking for
5+ years of experience in security operations, incident response, threat hunting, or a closely related cybersecurity function.
Experience managing outsourced SOC providers, including setting expectations, overseeing performance, and ensuring effective monitoring and incident response.
Proven ability to build and scale security operations teams, including defining processes, roles, workflows, and operating procedures.
Deep hands-on experience with SIEM platforms such as Splunk, Microsoft Sentinel, or Elastic, including developing, tuning, and maintaining detection content.
Strong expertise with EDR solutions and endpoint forensics, with the ability to investigate and respond to sophisticated endpoint threats.
Strong understanding of attacker techniques and tradecraft, including practical application of frameworks such as MITRE ATT&CK.
Solid technical foundation in networking, Windows and Linux operating systems, authentication, and identity management.
Scripting and automation skills using Python, PowerShell, or similar languages to support security analysis, investigation, and operational efficiency.
Excellent written and verbal communication skills, with the ability to clearly explain security incidents and technical risks to both engineering teams and executive stakeholders.
Strong judgment and decision-making skills, particularly when operating under pressure, during active incidents, and with incomplete or ambiguous information.
Nice to Haves
Experience securing cloud environments (AWS, GCP or Azure), including cloud-native logging and detection.
Familiarity with containers and Kubernetes security.
Experience with SOAR (Security Orchestration, Automation, and Response) platforms and detection-as-code workflows.
Malware analysis or reverse engineering experience.
Certifications such as GCIA, GCIH, GCFA, OSCP, CISSP, or equivalent practical experience
Exposure to compliance frameworks relevant to our business (SOC 2, ISO 27001, PCI DSS, HIPAA).
Who You Are
Challenge the Status Quo: Builds KOMOJU’s security operations capability from the ground up, continuously improving detection, response, and automation.
Impact Driven: Prioritizes measurable risk reduction by improving detection coverage, reducing false positives, accelerating incident response, and building an audit-ready security operations model that protects customers and supports KOMOJU’s growth.
Frontline Decision-Making & Ownership: Takes end-to-end ownership of security incidents, making timely, proportionate decisions under pressure and following through to resolution.
Obsession with Customer Value: Protects the sensitive payment and personal data entrusted to KOMOJU, strengthening merchant confidence and service reliability.
Multiplier: Partners with Engineering, SRE, IT, Compliance, and external SOC providers while sharing knowledge that improves security capability across the organization.
10 days regular vacation, additional 5 days summer, and year-end holidays.
Paid birthday holiday.
Budget for self-learning allowance, to ensure our employees’ skills remain current.
Access to the O’Reilly Learning Platform.
Language training for Japanese/ English
Twice a week office lunch.
Learning allowance.
By submitting your application, you agree that your personal data will be processed in accordance with our Privacy Policy solely for recruitment and evaluation purposes.