Security Engineer (SOC)

Accountabilities: You will develop and optimize SOC capabilities, improve threat detection, and help security teams respond to incidents more effectively. Your responsibilities will include:

• Build, operate, and continuously improve SOC platforms, including SIEM, SOAR, EDR, and XDR solutions.

• Integrate new log sources by managing parsing, normalization, and data quality.

• Develop and optimize detection rules and use cases using Sigma, KQL, and SPL, aligned with the MITRE ATT&CK framework.

• Automate security analysis and incident response through playbooks and scripting with Python and PowerShell.

• Establish Detection-as-Code pipelines with version control, testing, and CI/CD integration.

• Integrate threat intelligence into security monitoring and operational workflows.

• Collaborate with security analysts and incident responders to reduce false positives and improve detection quality.

• Provide technical support during security incidents and contribute to effective response activities.

• Create and maintain runbooks, use-case documentation, and technical concepts.

• Use AI-assisted tools to analyze logs, draft detection rules and playbooks, and produce documentation, ensuring all outputs are critically reviewed and validated before use.

• Apply strict data protection practices when using AI tools, preventing unauthorized disclosure and ensuring sensitive customer information is handled appropriately.

Requirements:

You bring substantial cybersecurity experience, strong technical expertise, and a responsible approach to AI-assisted security work. You should be comfortable working independently in a consulting environment while collaborating with technical teams and stakeholders. The key requirements include:

• At least five years of experience in IT or cybersecurity, including several years in architecture or consulting roles.

• Broad technical knowledge across networks, endpoints, identity, applications, and cloud environments.

• Experience with Zero Trust architectures, network segmentation, and IAM/PAM technologies, including Microsoft Entra ID and Active Directory.

• Strong understanding of security frameworks and methodologies, including ISO 27001, BSI IT-Grundschutz, NIST CSF, MITRE ATT&CK, and SABSA or TOGAF.

• Knowledge of cryptography, public key infrastructure (PKI), and secure application design.

• Confident use of AI tools in consulting workflows, including the ability to critically assess their outputs.

• Strong awareness of AI-related confidentiality and security risks, including data leakage, model training, and prompt injection.

• Willingness to continuously improve processes and products through responsible AI adoption.

• Professional fluency in both German and English.

Additional qualifications that would be an advantage:

• Cloud architecture expertise covering the design, security, and operation of cloud and hybrid environments across Azure, AWS, or GCP.

• Familiarity with cloud-native security services and Infrastructure as Code.

• Experience with prompt engineering, AI agents, or integrating large language models (LLMs) into workflows.

• Knowledge of AI governance frameworks and regulations, including the EU AI Act, ISO/IEC 42001, and the OWASP Top 10 for LLM Applications.

• Experience working in regulated environments, such as critical infrastructure (KRITIS), financial services, or industrial and OT settings.

• Relevant security certifications, such as OSDA, OSCP, SANS/GIAC certifications (including GCDA, GDSA, and GCIH), SANS SEC586, or Microsoft SC-200.

Benefits:

• Competitive compensation: Fixed annual salary starting at €80,000, plus profit sharing of up to €70,000.

• Fully remote work: Location-independent work on cybersecurity and AI security projects.

• Flexible working hours: Greater flexibility in organizing your working day.

• Generous leave: 30 days of annual vacation.

• Technology equipment: Apple MacBook and other necessary IT equipment.

• Retirement and health benefits: Occupational pension provision and health insurance.

• Employee discounts: Access to shopping offers and employee discounts.

• Team events: Regular opportunities to connect and collaborate with colleagues.

• Permanent employment: An open-ended employment contract.

• Professional development: Opportunities to deepen your expertise in SOC platforms, detection engineering, automation, cloud security, and responsible AI adoption.

• Meaningful technical work: Contribute to security projects that help protect critical digital environments and strengthen modern security operations.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best!  Why Apply Through Jobgether?    Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.     #LI-CL1