Incident Response Engineer: Lead Detection & Playbooks

Cassa Dei Medici; Schweiz; Sur place; EUR 96 742 - 161 238; Plein temps

Résumé du poste

Ärztekasse Genossenschaft is seeking an experienced security engineer to strengthen our incident response capabilities as we renew our datacenter. You will triage alerts from Defender, investigate incidents and coordinate remediation with engineering and operations teams.

The role requires hands-on Defender for Endpoint experience, SIEM familiarity, and scripting skills. You’ll help harden our environments on Windows and Linux while participating in on-call rotations and continuous detection

Qualifications

• 3+ years of experience in security incident response, SOC or similar roles.
• Hands-on experience with Microsoft Defender for Endpoint (EDR).
• Strong knowledge of security monitoring, SIEM, and detection engineering.
• Experience with Windows and Linux security; Kubernetes is a plus.
• Scripting in Bash, Python, or Go; relevant certifications (GCIH, GCIA, OSCP) are a plus.
• English required; German or French a plus.

Responsabilités

• Triage, investigate and resolve endpoint security alerts from Microsoft Defender.
• Detect, analyse and respond to security incidents across endpoints, infrastructure and applications.
• Lead incident response activities and coordinate remediation with engineering and operations teams.
• Tune detection rules to reduce false positives and continuously improve alert quality.
• Develop and maintain incident response playbooks, processes and tooling.
• Monitor security events and alerts (Microsoft Defender, SIEM, IDS/IPS) and drive continuous detection improvements.
• Conduct post-incident reviews and root-cause analysis, and track corrective actions.
• Participate in future on-call rotation.
• Implement security best practices and harden systems against emerging threats.

Connaissances

Incident response

Microsoft Defender for Endpoint

SIEM

Attack techniques knowledge

Windows security

Linux security

Scripting Bash/Python/Go

Certifications (GCIH GCIA OSCP)

English

German/French knowledge

Outils

Microsoft Defender for Endpoint

SIEM tooling

Kubernetes

Description du poste

Ärztekasse Genossenschaft is seeking an experienced security engineer to strengthen our incident response capabilities as we renew our datacenter. You will triage alerts from Defender, investigate incidents and coordinate remediation with engineering and operations teams.

The role requires hands-on Defender for Endpoint experience, SIEM familiarity, and scripting skills. You’ll help harden our environments on Windows and Linux while participating in on-call rotations and continuous detection