Security Engineer – SOC
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Security Engineer developing SOC detection systems for APT-ONE, a Berlin cybersecurity consultancy. Building SIEM/XDR platforms, detection-as-code pipelines, and AI-assisted security workflows.
Responsibilities:
- Build, operate, and continuously enhance SOC platforms (SIEM, SOAR, EDR/XDR)
- Onboard new log sources, including parsing, normalization, and ensuring data quality
- Develop and optimize detection rules and use cases with Sigma, KQL, and SPL based on MITRE ATT&CK
- Automate analysis and response processes through playbooks and scripting with Python and PowerShell
- Build detection-as-code pipelines, including version control, testing, and CI/CD
- Integrate and operationalize threat intelligence
- Work closely with analysts and incident responders to reduce false positives and improve detection quality
- Provide technical support during security incidents
- Create runbooks, use-case documentation, and technical concepts
- Use AI-powered tools for log analysis, drafting rules and playbooks, and documentation, including expert validation and approval of the results
Requirements:
- Confidently use AI tools in day-to-day consulting work, including critically evaluating their results
- Demonstrate a strong awareness of confidentiality when using AI; understand the risks of data leakage, model training, and prompt injection
- Willingness to continuously enhance processes and products using AI
- At least 5 years of experience in IT/cybersecurity, including several years in architecture or consulting roles
- Broad understanding of technologies across networking, endpoints, identity, applications, and cloud
- Experience with Zero Trust and segmentation concepts, as well as IAM/PAM (Entra ID, Active Directory)
- Proficiency with ISO 27001, BSI IT-Grundschutz, NIST CSF, MITRE ATT&CK, and SABSA/TOGAF
- Knowledge of cryptography, PKI, and secure application design
- Fluent German and English, both written and spoken
- Strong advantage: Cloud architecture expertise in Azure, AWS, GCP, cloud-native security services, and infrastructure as code
- Strong advantage: Experience with prompt engineering, AI agents, or integrating LLMs into workflows
- Strong advantage: Knowledge of AI governance (EU AI Act, ISO/IEC 42001, OWASP Top 10 for LLM Applications)
- Strong advantage: Experience in regulated environments (critical infrastructure, financial services, industry/OT)
- Certifications are a plus: OffSec, OSDA, OSCP, SANS/GIAC, GCDA, GDSA, GCIH, SANS SEC586, and Microsoft SC-200
Benefits:
- Base salary from €80,000 plus profit sharing of up to €70,000
- Flexible working hours
- Remote work
- 30 days of vacation
- IT equipment, such as an Apple MacBook
- Regular team events
- Company pension plan
- Health insurance
- Shopping and employee discounts
Similar Jobs
Director of Security Operations
Director of Security Operations leading Backblaze’s cybersecurity monitoring, incident response, and vulnerability programs. Driving AI-assisted defenses, automation, and operational resilience across cloud and distributed environments.
HR Operations Analyst – Security & Apps
HR operations security analyst optimizing NBCUniversal’s global HR applications and access systems. Managing security access, audits, application releases, and HR technology improvements.
Security Operations Analyst
Security Operations Analyst defending Unqork’s AI-powered enterprise application platform. Monitoring threats, engineering SIEM/SOAR detections, and supporting incident response and compliance.
Tier 2 SOC Analyst
Tier 2 SOC Analyst investigating and containing escalated SIEM and EDR threats for federal and Fortune 100 clients. Developing runbooks, managing vulnerabilities, and meeting overnight incident-response SLAs.
Tier 1 SOC Analyst
Tier 1 SOC Analyst monitoring SIEM and EDR alerts for Dragonfli Group’s federal and Fortune 100 cybersecurity clients. Triaging incidents, tracking vulnerabilities, and escalating overnight events.
Associate SOC Analyst
Associate SOC Analyst protecting Expel customers through managed detection and response. Investigating alerts, hunting threats, and responding across endpoint and cloud environments.
Director of Security Operations
Aledade, a value-based primary-care network, seeking a remote Director of Security Operations in the United States. Leading SOC operations, incident response, threat intelligence, vulnerability management, and security teams.
Senior GRC Analyst, SOC 2
Senior GRC Auditor I ensuring client satisfaction through effective IT controls and compliance audits. Develops client relationships while leading external audits to meet industry standards.
Security Operations Engineer – Incident Response
Security Operations Engineer leading incident response and forensic investigations at ProCircular. Managing critical security incidents and developing detection methodologies in a SOC environment.
Security Operations Engineer
Security Operations Engineer managing security operations and compliance for AI functions in higher education. Ensuring data protection and security in cloud environments and IT operations.
Senior Security Engineer, Incident Response
Senior Security Engineer leading the technical response to incidents and enhancing security processes for Twilio. Working across R&D Engineering and Business teams on security challenges and incident management.
SecOps Transformation Advisor
SecOps Transformation Advisor driving XSIAM revenue and consultative sales strategy for cybersecurity solutions. Engaging executive relationships and providing business value through tailored proposals.
Security Operations Engineer
Security Operations Engineer providing technical and operational support for MDR customers at Vector3. Involved in incident response, troubleshooting, and security initiatives.
Cybersecurity Incident Response Triage Analyst
Cybersecurity Incident Response Triage IR Analyst working with the CIRT team at Accenture Federal Services. Monitoring, analyzing incidents, and developing response strategies to enhance cybersecurity for federal government entities.
Presales Security Architect – SecOps
Presales Security Architect at GuidePoint Security serving as a technical advisor. Leading technical discovery, design, and positioning in cybersecurity across the Northeast region.
Analyst, Security Operations
Analyst in Security Operations at Danaher handling security events, mentoring junior analysts, and developing relationships with Security and IT teams. Reviewing security alerts and improving security posture across a multinational corporation.
Cyber Operations Lead – Incident Response
Cyber Operations Lead responsible for managing cyber incident response operations at Chickasaw Nation Industries. Collaborating with teams to guide investigations and implement security strategies.
Senior SOC Analyst
Analista SOC Sênior responsible for security operations, monitoring, and incident response at a fintech. Collaborating with teams to secure systems and mitigate risks.
External Communications, Operations & Analytics Specialist – Experienced/Senior
Boeing seeks External Communications Specialist to shape communication strategies and engage key media stakeholders. Collaborate across teams to manage communications operations and content strategy.
Cybersecurity Operations Engineer
Cybersecurity Operations Engineer enhancing cybersecurity operations for business customers in Switzerland. Working end-to-end with customers from implementation to operations.