About The Company
Ouro is a global, vertically-integrated financial services and technology company dedicated to the delivery of innovative financial empowerment solutions to consumers worldwide. Ouro's financial products and services span prepaid, debit, cross-border payments, and loyalty solutions for consumers and enterprise partners.
Ouro's flagship product Netspend provides prepaid and debit account solutions that connect customers with secure, convenient access to global payment networks so they can manage their money and make everyday purchases. With a nationwide U.S. retail network, customers can purchase and reload Netspend products at 130,000 reload points and over 100,000 distributing locations.
Since Ouro's founding in 1999 by industry pioneers, Ouro products have processed billions of dollars in transaction volume and served millions of customers worldwide. The company is headquartered in Austin, Texas with employees worldwide.
Job Description
We are seeking a highly skilled Senior Security Incident Response Analyst to join our global Cyber Defense organization. This individual contributor role is responsible for
triaging and investigating security alerts, developing and maintaining response playbooks, and ensuring the effectiveness of security logging and detection capabilities. The ideal candidate brings deep technical expertise, strong analytical skills, and a passion for improving detection and response processes at scale. This role will collaborate closely with Security Operations, Threat Detection Engineering, Platform/Infrastructure teams, and cross-functional partners across global time zones. The position is based in India and may support a follow-the-sun incident response model.
Key Responsibilities
Incident Monitoring & Investigation
- Continuously monitor and triage security alerts from SIEM, EDR, cloud platforms, and
other detection systems
- Conduct end-to-end investigations for potential security incidents, including scoping,
containment recommendations, and root-cause identification
- Escalate and coordinate with global IR teams for high-severity incidents.
- Perform forensic analysis on endpoints, logs, and cloud workloads as required.
Response Playbooks & Process Improvement
- Design, build, and maintain incident response playbooks covering common threat
scenarios (malware, phishing, identity compromise, insider threat, cloud
misconfigurations, etc.)
- Identify opportunities for automation and orchestration in investigation workflows
- Collaborate with Threat Detection Engineering to refine detection logic, thresholds, and
alerting criteria
- Document incident findings, lessons learned, and process improvements.
Logging & Detection Efficacy
- Evaluate the completeness and quality of security logs across infrastructure,
applications, and cloud environments (AWS/Azure/GCP).
- Recommend improvements in logging coverage, enrichment, and parsing to strengthen
detection capabilities
- Partner with Security Engineering to validate telemetry ingestion and visibility in SIEM
and EDR platforms
- Conduct periodic logging health assessments and tune noisy or low-value alerts.
Stakeholder Collaboration
- Work with IT, Cloud, Engineering, and Compliance teams to ensure incident response
readiness
- Provide guidance to junior analysts and regional partners when required
- Support tabletop exercises and readiness assessments.
Requirements
- 5–8+ years of hands-on experience in Security Operations, Incident Response, Threat
Hunting, or Detection Engineering
- Strong knowledge of SIEM platforms (e.g., Splunk, ELK, Sentinel), EDR tools
(CrowdStrike, SentinelOne, etc.), and cloud security (AWS/GCP/Azure)
- Proven ability to investigate complex security events using logs, network traffic, and
endpoint data
- Experience building IR playbooks and standard operating procedures
- Familiarity with MITRE ATT&CK, NIST Incident Response Framework, and modern
adversary TTPs
- Solid understanding of logging architectures, event taxonomies, and detection pipelines.
- Excellent communication skills and ability to work independently in a global, distributed
environment
Preferred Qualifications
- Relevant certifications (GCIA, GCIH, GCFA, GNFA, Azure/AWS Security, etc.)
- Experience with SOAR automation workflows
- Exposure to DevOps, Kubernetes, container security, or CI/CD pipeline monitoring
- Prior experience working in a global 24/7 operational security model
