Staff Security Engineer - Detection & Response (w/m/d)

Build and own the SIEM

• Take ownership of the platform from the implementation partner, to a depth that allows you to defend or revise its design decisions
• Own data source onboarding, parsing, normalisation and coverage
• Make and justify explicit decisions on log coverage, retention and ingest cost
• Develop the platform as the estate grows, rather than leaving it as delivered

Detection engineering

• Write, tune and maintain the detection content, beyond the vendor's default rule set
• Map coverage against the techniques relevant to our estate and close the gaps that matter
• Treat detections as code: version control, review, testing, and a defined process for false positives
• Convert offensive security findings into detections

Incident response

• Investigate and lead the technical side of security incidents end to end
• Threat hunting against our own telemetry, proactively rather than in response to a report
• Own the technical half of the incident response process and refine it after each event

Hardening

• Design and roll out security baselines across endpoints, servers, identity and cloud
• Work with IT and engineering to get them applied, including where that requires making the case
• Measure configuration drift and close it

Partners and tooling

• Own the engineering relationship with our external security partners: scope, escalation and expectations
• Make build-versus-buy decisions on detection and response tooling, including the cost implications

• You have built or substantially rebuilt a detection capability, rather than only operating one designed by someone else
• You have written and tuned detection content in a production SIEM yourself, and are fluent in its query language
• You have personally investigated real security incidents from start to finish
• You have designed and rolled out a hardening baseline
• You script to a level where automation is your default: PowerShell, Python or equivalent
• You have set a technical standard that others followed, without formal authority over them
• Fluent English, written and spoken

• Remote-first within Germany, with the option to work remotely from eligible countries for up to 180 days per year
• Meal allowance of up to €115 net per month
• Ergonomic workspace allowance for your home office setup
• Regular team events, company-wide gatherings, and summer and Christmas parties to stay connected as a remote-first company
• EGYM Wellpass and JobRad subsidy
• Financial benefits including capital-forming payments (Vermögenswirksame Leistungen) and a company pension scheme