Cyber Defense Specialist (f/m/x)

Raiffeisen Bank International AG; Wien; Remote; EUR 34,000 - 41,000; Full time

Benefits offered by this job

Flexible hours

Work-from-home options from Austria

Global community

Career growth

Stay healthy

Save money

Family support

Competitive salary

Job summary

Raiffeisen Bank International AG is seeking a dedicated SOC professional to enhance security monitoring, threat hunting, and detection development within our Group SOC. You will collaborate with IT and security engineers to onboard bank products and refine detection logic, while leveraging AI-assisted triage and simulation tooling to continuously improve our security posture.

Ideal candidates bring hands-on monitoring experience, knowledge of MITRE ATT&CK, and proficiency with SIEM platforms.

Qualifications

• Hands-on experience in security monitoring and incident detection within a Security Operations Center (SOC).
• Strong understanding of MITRE ATT&CK, Cyber Kill Chain and other attack models.
• Experience configuring, maintaining and improving SIEM platforms.

Responsibilities

• Provide effective security monitoring through triage, investigation, communication and reporting.
• Conduct threat hunting investigations and refine detection use cases to improve detection coverage.
• Build and tune tactical and strategic mitigation plans to improve security posture.
• Collaborate with IT and security engineers to onboard bank products and develop SOC use cases.
• Engage with AI-assisted triage and adversary simulation tooling to shape deployment.
• Review automated attack simulation results and translate coverage gaps into concrete tasks.

Skills

Security monitoring

Threat hunting

MITRE ATT&CK

SIEM

Python/PowerShell

LLM tools

Offensive tool familiarity

ATT&CK tests

CTI platforms

AI/LLM awareness

Job description

Select how often (in days) to receive an alert:

RBI is fostering its Business by strengthening its information and cyber security capabilities for the next generation.

As a crucial part of Raiffeisen Bank International's Group Cyber Defense Center, this function develops detection and prevention mechanisms to support our digitalization journey and maintain our customers' confidence.

In this position, you will be a member of our Group SOC team. This includes providing effective security monitoring through triage, investigation, communication and reporting. You will be encouraged to conduct your own threat hunting investigations, create and refine detection use cases, and build tactical and strategic mitigation plans that measurably improve our security posture. You will work together with IT and security engineers to onboard bank products and build the cyber security use cases needed to protect them. You will also work hands-on with the AI-assisted and semi-autonomous tooling we are introducing across the SOC, and your judgement will shape how far we take it.

What you can expect:

• Enhance threat intelligence by leveraging technology and information available from both internal and external sources
• Perform threat management and threat modelling, identify threat vectors, and develop use cases for security monitoring
• Analyze and assess damage to data and infrastructure resulting from security incidents, examine available recovery tools and processes, and recommend solutions
• Validate and tune your own detection use cases by safely reproducing attacker techniques in our lab environment - we expect you to know what your rules look like when they fire
• Take part in purple team exercises with our Adversary Simulation colleagues and turn observed attack behavior into reliable detection logic
• Review the results of automated attack simulation runs and translate detection coverage gaps into concrete tuning and engineering tasks

Where we are going with AI:

RBI has its own AI strategy, and we are deliberately building towards an agentic SOC: analysts supported by semi-autonomous processes covering enrichment, correlation, use-case quality assurance, threat hunting support and reporting. We are hiring people who want to shape that, not watch it happen.

• You will work with AI-assisted triage, hunting and reporting from day one, and your feedback on where it helps - and where it is confidently wrong - will directly steer how we build it
• You will help develop detection coverage for the bank’s own AI adoption: our monitoring scope now includes AI and LLM workloads, not just traditional infrastructure
• We would rather you automate your repetitive work than do it twice - contributions to detection-as-code and SOAR playbook development are explicitly part of the role

What you bring to the table:

• Hands-on experience in security monitoring and incident detection within a Security Operations Center
• Strong understanding of the MITRE ATT&CK framework, the Cyber Kill Chain and other attack models
• Hands-on experience configuring, maintaining and improving SIEM platforms
• Practical understanding of how common attack techniques are executed - we value analysts who can reproduce a technique in a lab and recognize the traces it leaves in telemetry, rather than knowing it only from a framework
• Ability to write Python or PowerShell scripts to automate tasks, enrich security data and validate detections
• Practical experience using LLM-based tools in your daily work, including effective prompting, recognizing unreliable output and verifying results before acting on them
• Familiarity with common offensive tools (e.g. BloodHound, Impacket, Mimikatz and C2 frameworks) and the forensic artefacts they leave behind is an asset
• Experience running ATT&CK-aligned tests using tools such as Atomic Red Team or Caldera, or working with breach and attack simulation platforms, is an asset
• Experience working with cyber threat intelligence (CTI) platforms is an asset
• Awareness of security risks associated with AI and LLMs, such as prompt injection and data leakage, and familiarity with the OWASP Top 10 for LLM Applications are assets
• Vendor-independent security certifications (e.g. CISA, CRISC, CISSP or CEH) are an asset
• A hands-on offensive security certification (e.g. OSCP or GPEN), or equivalent experience with advanced labs such as Hack The Box Pro Labs, is a welcome addition - but this is a defensive role, not a full-time penetration testing position

What’s in it for you:

• Work-Life-Balance: Flexible hours, work-from-home options from Austria
• Global community: 75+ nationalities, English as the company language, and work permit support. Our teams thrive on collaboration and mutual respect.
• Career growth: We believe in continuous learning and proactive career development. Take on challenging work that stretches your abilities, attend trainings, and use new technologies to make a lasting impact.
• Stay healthy: Subsidized canteen, well-being programs, check-ups, and sport allowances.
• Save money: Discounts, exclusive banking terms, and a free public transport pass.
• Family support: Child allowances, gender-neutral parental leave, bilingual company kindergarten, and holiday childcare.
• Competitive salary: In accordance with Austrian legal requirements, the minimum salary for this position is EUR 3.375,40 gross per month under the applicable Banking Collective Agreement. The actual salary is typically higher and will be determined individually based on your qualifications, professional experience, and the specific requirements of the role.

Build a career where your work truly matters. At Raiffeisen Bank International, with more than 17 million customers across Austria and CEE, it's our people who make the difference. From day one, you'll take responsibility, grow beyond ladders and org charts, and help us deliver lasting value to our customers. We are dedicated to fostering diversity, inclusiveness, and equity - striving to create a culture where every voice is heard and every individual feels valued and respected.

Your benefits at one sight:

Join a team that values your well-being and professional development, offering a variety of benefits to support your success.

Don't just watch your future happen.
Make it happen.