KaaIoT

We are looking for a practical security engineer who can improve detection quality, investigate real incidents, and help reduce manual SOC work.

This role is not about building an “AI security platform”. The focus is on better visibility, cleaner detections, faster investigations, and useful automation.

What You Will Work On

Threat Hunting
• Run targeted hunts based on clear hypotheses, including:

• Suspicious cloud activity
• Abnormal IAM or API usage
• Unusual network or application behavior
• Weak or missing detection coverage
• Gaps in logging and telemetry

• Use internal data and external threat intelligence to validate risks and improve detection logic.

Security Incident Investigation
• Investigate security alerts and incidents end-to-end:

• Understand what happened
• Validate whether the alert is real or noisy
• Identify affected users, systems, and data
• Collect evidence from logs and infrastructure
• Document findings clearly
• Recommend fixes or detection improvements

• Expected experience: 2+ years of hands-on security incident investigation.

Detection Engineering
• Improve existing detections and create new ones where needed:

• Reduce false positives
• Improve signal quality
• Tune alerts based on real data
• Validate whether detections catch meaningful activity
• Map useful detections to MITRE ATT&CK where appropriate

Automation and Internal Tooling
• Build small but useful tools to reduce repetitive work:

• Scripts for log analysis
• Alert enrichment
• Investigation helpers
• Data normalization
• Tool integrations
• Basic SOAR-style automation

Practical AI / LLM Usage
• Use LLMs only where they bring practical value:

• Alert enrichment
• Investigation summaries
• Internal tooling
• Analyst productivity

No hype. No AI-first positioning. AI is just one tool in the workflow.

Requirements
• Solid experience with SIEM tools, such as:

• Elastic
• Splunk
• Microsoft Sentinel
• Similar platforms

• 2+ years investigating real security incidents

• Strong understanding of:

• AWS logs and IAM activity
• Cloud security basics
• Network fundamentals
• APIs, authentication flows, and modern application behavior

• Comfortable working with:

• Large datasets
• Raw logs
• Noisy alerts
• Incomplete telemetry

• Python or similar language for data processing

• Experience with automation:

• SOAR
• Scripts
• Internal tools
• Custom workflows

• Basic DevOps knowledge:

• AWS
• Linux
• Docker
• Kubernetes basics
• CI/CD basics
• Cloud infrastructure concepts
• Logs, metrics, and monitoring

Nice to Have
• Experience applying simple ML or statistical methods to logs
• Familiarity with LLMs in internal tooling
• Experience with data pipelines:

• Kafka
• Spark
• Similar systems

• MITRE ATT&CK mapping
• Detection-as-code experience

• Understanding of infrastructure monitoring:

• Prometheus
• Grafana
• OpenTelemetry

What Will Make You Effective Here
You will be effective in this role if:
• You do not trust alerts blindly
• You care about signal quality, not the number of detections
• You can explain why a detection is noisy or useless
• You understand systems, not just security tools
• You are comfortable reading raw logs
• You prefer building automation once instead of repeating manual work
• You can work with engineers and explain security findings in practical terms

About the company

Our client is a leading autonomous vehicle technology company operating at the cutting edge of self-driving software development. 

Role overview

We are not looking for a traditional SOC analyst. This role is about building detection systems, not clicking through alerts. You will work with large volumes of logs (cloud, application, network), design detection logic, and improve it over time. That includes both rule-based detection (SIEM/XDR) and data-driven approaches (statistical models, anomaly detection, simple ML where it makes sense). You should be comfortable treating logs as a data problem, not just a monitoring stream.

Important! This is not a role where you:

• sit in SIEM all day clicking alerts
• blindly add rules
• overcomplicate things with ML

This is a role where you: build detection systems that work in practice.

What you'll be doing

Detection & analytics

• Build and maintain detections across:
• application logs (auth, APIs, business logic abuse)
• cloud activity (CloudTrail, IAM, infrastructure changes)
• network telemetry (DNS, proxy, firewall, NetFlow)
• Work directly with data in platforms like Elasticsearch / Splunk / similar
• Write and tune detection logic (queries, correlation rules)
• Reduce noise — expect to spend time fixing false positives, not just adding new rules.

Working with data (this is a big part of the job)

• Build pipelines for:
• log ingestion
• normalization
• feature extraction
• Work with streaming or batch pipelines (Kafka / queues / scheduled jobs)
• Turn raw logs (e.g. CloudTrail) into structured data usable for detection.

Anomaly detection / ML (practical, not theoretical)

• Apply simple models where they add value (e.g. One-Class SVM or similar approaches)
• Focus on:
• behavior baselining
• anomaly scoring
• Tune models based on real output (false positives matter more than theory) 
• If ML does not improve signal — don't use it.

Automation & response

• Build response playbooks for common cases
• Automate where it actually saves time (not for the sake of it)
• Integrate with SOAR or write lightweight orchestration
• Improve:
• detection speed
• response consistency.

AI usage (realistic expectations)

• Use LLMs for:
• alert enrichment
• investigation summaries
• internal tooling
• Not building an "AI security platform"
• Focus on practical gains, not hype.

Threat hunting

• Run targeted hunts based on hypotheses
• Use internal data + external signals
• Identify gaps in logging and detection.

Requirements

• Solid experience with SIEM (Elastic, Splunk, Sentinel, etc.)
• Strong understanding of:
• cloud activity (especially AWS logs and IAM)
• network basics
• modern application behavior (APIs, auth flows)
• Comfortable working with large datasets (not afraid of raw logs)
• Python or similar for data processing
• Experience with automation (SOAR or custom scripts).

Nice-to-have (but not critical)

• Experience applying ML to logs (even simple models is enough)
• Familiarity with LLMs in tooling (not research)
• Experience with data pipelines (Kafka, Spark, etc.)
• MITRE ATT&CK mapping

What will make you effective here

• You don't trust alerts blindly
• You care about signal quality, not number of detections
• You can debug why a detection is noisy or useless
• You understand systems, not just tools
• You prefer building something once instead of repeating manual work.

How success looks like

• Fewer false positives
• Better visibility across systems
• Faster investigations
• Less manual work in SOC
• Detections that actually catch real issues

Role overview:

We are looking for a practical security engineer who can improve detection quality, investigate real incidents, and help reduce manual SOC work.

This role is not about building an “AI security platform”. The focus is on better visibility, cleaner detections, faster investigations, and useful automation.

What You Will Work On:

Threat Hunting

Run targeted hunts based on clear hypotheses, including:

• Suspicious cloud activity
• Abnormal IAM or API usage
• Unusual network or application behavior
• Weak or missing detection coverage
• Gaps in logging and telemetry

You will use internal data and external threat intelligence to validate risks and improve detection logic.

Security Incident Investigation

Investigate security alerts and incidents end-to-end:

• Understand what happened
• Validate whether the alert is real or noisy
• Identify affected users, systems, and data
• Collect evidence from logs and infrastructure
• Document findings clearly
• Recommend fixes or detection improvements

Expected experience: 2+ years of hands-on security incident investigation.

Detection Engineering

Improve existing detections and create new ones where needed:

• Reduce false positives
• Improve signal quality
• Tune alerts based on real data
• Validate whether detections catch meaningful activity
• Map useful detections to MITRE ATT&CK where appropriate.

Automation and Internal Tooling

Build small but useful tools to reduce repetitive work:

• Scripts for log analysis
• Alert enrichment
• Investigation helpers
• Data normalization
• Tool integrations
• Basic SOAR-style automation

Practical AI / LLM Usage

Use LLMs only where they bring practical value:

• Alert enrichment
• Investigation summaries
• Internal tooling
• Analyst productivity

No hype. No AI-first positioning. AI is just one tool in the workflow.

Requirements:

• Solid experience with SIEM tools, such as: Elastic, Splunk, Microsoft Sentinel, Similar platforms
• 2+ years investigating real security incidents
• Strong understanding of: - AWS logs and IAM activity - Cloud security basics - Network fundamentals - APIs, authentication flows, and modern application behavior
• Comfortable working with: Large datasets; Raw logs; Noisy alerts; Incomplete telemetry
• Python or similar language for data processing
• Experience with automation: SOAR, Scripts, Internal tools, Custom workflows
• Basic DevOps knowledge: - AWS - Linux - Docker - Kubernetes basics - CI/CD basics - Cloud infrastructure concepts - Logs, metrics, and monitoring.

Nice-to-have (but not critical):

• Experience applying simple ML or statistical methods to logs
• Familiarity with LLMs in internal tooling
• Experience with data pipelines (Kafka, Spark, Similar systems)
• MITRE ATT&CK mapping
• Detection-as-code experience
• Understanding of infrastructure monitoring (Prometheus, Grafana, OpenTelemetry)

What will make you effective here:

• You do not trust alerts blindly
• You care about signal quality, not the number of detections
• You can explain why a detection is noisy or useless
• You understand systems, not just security tools
• You are comfortable reading raw logs
• You prefer building automation once instead of repeating manual work
• You can work with engineers and explain security findings in practical terms

Location: Remote

Team: Security / Platform

About the company

Our client is a leading autonomous vehicle technology company operating at the cutting edge of self-driving software development. 

Role overview

We are not looking for a traditional SOC analyst. This role is about building detection systems, not clicking through alerts. You will work with large volumes of logs (cloud, application, network), design detection logic, and improve it over time. That includes both rule-based detection (SIEM/XDR) and data-driven approaches (statistical models, anomaly detection, simple ML where it makes sense). You should be comfortable treating logs as a data problem, not just a monitoring stream.

Important! This is not a role where you:

• sit in SIEM all day clicking alerts
• blindly add rules
• overcomplicate things with ML

This is a role where you: build detection systems that work in practice.

What you'll be doing

Detection & analytics

• Build and maintain detections across:
• application logs (auth, APIs, business logic abuse)
• cloud activity (CloudTrail, IAM, infrastructure changes)
• network telemetry (DNS, proxy, firewall, NetFlow)
• Work directly with data in platforms like Elasticsearch / Splunk / similar
• Write and tune detection logic (queries, correlation rules)
• Reduce noise — expect to spend time fixing false positives, not just adding new rules.

Working with data (this is a big part of the job)

• Build pipelines for:
• log ingestion
• normalization
• feature extraction
• Work with streaming or batch pipelines (Kafka / queues / scheduled jobs)
• Turn raw logs (e.g. CloudTrail) into structured data usable for detection.

Anomaly detection / ML (practical, not theoretical)

• Apply simple models where they add value (e.g. One-Class SVM or similar approaches)
• Focus on:
• behavior baselining
• anomaly scoring
• Tune models based on real output (false positives matter more than theory) 
• If ML does not improve signal — don't use it.

Automation & response

• Build response playbooks for common cases
• Automate where it actually saves time (not for the sake of it)
• Integrate with SOAR or write lightweight orchestration
• Improve:
• detection speed
• response consistency.

AI usage (realistic expectations)

• Use LLMs for:
• alert enrichment
• investigation summaries
• internal tooling
• Not building an "AI security platform"
• Focus on practical gains, not hype.

Threat hunting

• Run targeted hunts based on hypotheses
• Use internal data + external signals

• Identify gaps in logging and detection.

   

Requirements

• Solid experience with SIEM (Elastic, Splunk, Sentinel, etc.)
• Strong understanding of:
• cloud activity (especially AWS logs and IAM)
• network basics
• modern application behavior (APIs, auth flows)
• Comfortable working with large datasets (not afraid of raw logs)
• Python or similar for data processing

• Experience with automation (SOAR or custom scripts).

   

Nice-to-have (but not critical)

• Experience applying ML to logs (even simple models is enough)
• Familiarity with LLMs in tooling (not research)
• Experience with data pipelines (Kafka, Spark, etc.)

• MITRE ATT&CK mapping

   

What will make you effective here

• You don't trust alerts blindly
• You care about signal quality, not number of detections
• You can debug why a detection is noisy or useless
• You understand systems, not just tools

• You prefer building something once instead of repeating manual work.

   

How success looks like

• Fewer false positives
• Better visibility across systems
• Faster investigations
• Less manual work in SOC
• Detections that actually catch real issues

Requirements:

• 1–3 years of commercial development experience;
• Strong knowledge of JavaScript and TypeScript;
• Experience with Node.js and/or Bun.js;
• Experience with Vue.js is preferred; React is also acceptable;
• Good understanding of full-stack web application development;
• Understanding of WebSockets and real-time communication;
• Experience working with PostgreSQL;
• Good understanding of asynchronous programming;
• Confident working with the Git version control system;
• Strong analytical and problem-solving skills;
• Intermediate level of English.

Would be a plus:

• Experience with modern backend architecture and API design;
• Experience working with ORMs or query builders;
• Familiarity with deployment, CI/CD, and cloud environments;
• Experience building scalable products or SaaS platforms.
• Experience using AI tools for coding to improve productivity;

Responsibilities:

• Develop and maintain full-stack product features with attention to quality and performance;
• Participate in end-to-end development, from idea to production;
• Build both backend and frontend parts of the application;
• Work with real-time features using WebSockets;
• Deliver features quickly and efficiently.

Requirements:

• 1–3 years of commercial development experience;
• Strong knowledge of JavaScript and TypeScript;
• Experience with Node.js and/or Bun.js;
• Experience with Vue.js is preferred; React is also acceptable;
• Good understanding of full-stack web application development;
• Understanding of WebSockets and real-time communication;
• Experience working with PostgreSQL;
• Good understanding of asynchronous programming;
• Confident working with the Git version control system;
• Strong analytical and problem-solving skills;

• Intermediate level of English.

   

Would be a plus:

• Experience with modern backend architecture and API design;
• Experience working with ORMs or query builders;
• Familiarity with deployment, CI/CD, and cloud environments;
• Experience building scalable products or SaaS platforms.

• Experience using AI tools for coding to improve productivity;

   

Responsibilities:

• Develop and maintain full-stack product features with attention to quality and performance;
• Participate in end-to-end development, from idea to production;
• Build both backend and frontend parts of the application;
• Work with real-time features using WebSockets;
• Deliver features quickly and efficiently;

About the Role:

Ми шукаємо інженера прошивок, який реально вміє працювати з сучасним залізом (ESP32-S3, PICAD-сумісні плати) та Zephyr OS. Основне завдання — писати стійкий, production-ready код для IoT-пристроїв рівня “data logger / gateway”: сенсори, Modbus, LTE/Wi-Fi, OTA, локальна логіка, енергозбереження.

Жодного академічного R&D — потрібна людина, яка швидко робить робочий продукт.

Responsibilities:

• Розробка firmware під Zephyr OS для ESP32-S3 / ESP32-C6;
• Робота з PICAD-сумісною периферією (датчики, інтерфейси, IO);
• Реалізація протоколів: Modbus RTU/TCP, UART, RS-485, SPI, I2C;
• Налаштування мережевих стеків: Wi-Fi, LTE (через зовнішні модулі), MQTT;
• OTA-оновлення (MCUboot, зразки Zephyr, кастомні схеми);
• Буферизація даних, локальний storage, fallback-режими;
• Інтеграція з backend API (REST/MQTT), обробка queue/telemetry;
• Оптимізація енергоспоживання та продуктивності;
• Написання unit-/integration-tests, робота з hardware-bring-up.

Requirements:

• Глибокий досвід розробки прошивок на C/C++;
• Комерційний досвід із Zephyr RTOS обов’язковий (device tree, Kconfig, drivers, subsystems);
• Практичний досвід роботи з ESP32-S3 / ESP32-C3 / ESP32-C6;
• Розуміння MCUboot, partition layout, OTA-pipeline;
• Уміння працювати з периферією: UART, SPI, I2C, PWM, ADC, RS-485;
• Досвід роботи з Modbus (master/slave), бажано з реальними пристроями;
• Досвід дебагу: JTAG, OpenOCD, logic analyzer;
• Git, CI/CD, уміння працювати в нормальному продукті, а не «прошивка нашвидкуруч».

Nice to have:

• BLE (Zephyr BT stack);
• Python для tooling (скрипти, тести, виробничі тулзи).

We Offer:

• Робота над реальним IoT-продуктом (energy logger / gateway), який уже йде у виробництво;
• Можливість професійного зростання та кар’єрного розвитку;
• Відпустка — 18 робочих днів на рік;
• Дружнє робоче середовище;
• Лікарняний — 5 робочих днів (без документів);
• Медичне страхування.

About the Role:

Ми шукаємо інженера прошивок, який реально вміє працювати з сучасним залізом (ESP32-S3, PICAD-сумісні плати) та Zephyr OS. Основне завдання — писати стійкий, production-ready код для IoT-пристроїв рівня “data logger / gateway”: сенсори, Modbus, LTE/Wi-Fi, OTA, локальна логіка, енергозбереження.

Жодного академічного R&D — потрібна людина, яка швидко робить робочий продукт.

Responsibilities:

• Розробка firmware під Zephyr OS для ESP32-S3 / ESP32-C6;
• Робота з PICAD-сумісною периферією (датчики, інтерфейси, IO);
• Реалізація протоколів: Modbus RTU/TCP, UART, RS-485, SPI, I2C;
• Налаштування мережевих стеків: Wi-Fi, LTE (через зовнішні модулі), MQTT;
• OTA-оновлення (MCUboot, зразки Zephyr, кастомні схеми);
• Буферизація даних, локальний storage, fallback-режими;
• Інтеграція з backend API (REST/MQTT), обробка queue/telemetry;
• Оптимізація енергоспоживання та продуктивності;
• Написання unit-/integration-tests, робота з hardware-bring-up.

Requirements:

• Глибокий досвід розробки прошивок на C/C++;
• Комерційний досвід із Zephyr RTOS обов’язковий (device tree, Kconfig, drivers, subsystems);
• Практичний досвід роботи з ESP32-S3 / ESP32-C3 / ESP32-C6;
• Розуміння MCUboot, partition layout, OTA-pipeline;
• Уміння працювати з периферією: UART, SPI, I2C, PWM, ADC, RS-485;
• Досвід роботи з Modbus (master/slave), бажано з реальними пристроями;
• Досвід дебагу: JTAG, OpenOCD, logic analyzer;
• Git, CI/CD, уміння працювати в нормальному продукті, а не «прошивка нашвидкуруч».

Nice to have:

• BLE (Zephyr BT stack);
• Python для tooling (скрипти, тести, виробничі тулзи).

We Offer:

• Робота над реальним IoT-продуктом (energy logger / gateway), який уже йде у виробництво;
• Можливість професійного зростання та кар’єрного розвитку;
• Відпустка — 18 робочих днів на рік;
• Дружнє робоче середовище;
• Лікарняний — 5 робочих днів (без документів);
• Медичне страхування.