Security Analyst Expert (m/f/x)

JobsinAustria; Wiener Neudorf; Vor Ort; EUR 63.000 - 77.000; Vollzeit

Benefits dieser Stelle

Flexible work options

Training & development

Parking

Lunch allowance

Staff discounts

Zusammenfassung

REWE Group Austria's IT team (700+ staff) seeks a Security Analytics Specialist to monitor and analyze data from our SOC platform, guiding post‑incident analysis and platform improvements.

You will implement runbooks, contribute to expanding the SOC offering, and collaborate with infrastructure and security teams to stay ahead of threats using trusted sources. Fluent English required, local German welcome.

Qualifikationen

• Completed studies in computer science or information security, or comparable hands-on training.
• CISSP, GIAC or similar certifications are a plus.
• Familiarity with SOC frameworks such as MITRE/Cyber Kill Chain.
• Experience with Windows/AD and Linux administration.
• Ability to communicate complex topics clearly in English.

Aufgaben

• Respond to security incidents per policy and procedures.
• Communicate findings to stakeholders to improve security posture.
• Analyze threats and establish new use cases with SOC engineers.
• Create runbooks to automate or assist incident resolution.
• Help build and expand the SOC platform and services.
• Collaborate with infrastructure teams and the REWE Digital SOC.

Kenntnisse

SIEM

XDR

EDR

NDR

PAM

Kill Chain

MITRE

Network security

VPN

Firewall

Windows Admin

Active Directory

Linux admin

Python

PowerShell

English

Ausbildung

CS degree

Security certs

Tools

Splunk

SentinelOne

Proofpoint

CyberArk

Jobbeschreibung

As the IT of the REWE Group Austria, we work together with our more than 700 employees to develop innovative IT products and services for all our corporate divisions in Austria and abroad, setting the tone for modern trade.

As part of the Security Analytics discipline, you will be responsible for the continuous monitoring and analysis of the data provided by our toolset and platform used by the SOC. Together with the team, you'll analyze, investigate relevant events, alerts and information security incidents and provide valuable insights into improving our posture during post incident analysis. Further, your experience helps build up and constantly enhance the SOC platform and create an internal SOC service offering on top of it.

Job Description

• Respond to security incidents according to the security incident response policy and procedures
• Communicate investigation findings to relevant stakeholders to help improve the information security posture
• Analyze potential impact of new threats and establish new use cases together with our security platform engineers
• Perform or participate in root-cause analysis to document findings, and participate in root-cause elimination activities as required
• Create runbooks for frequently occurring incidents to automate or at least assist with the resolution of those cases
• Assist in building, enhancing and expanding the SOC platform
• Help creating an internal SOC service offering
• Work in close partnership with our infrastructure teams, information security officer and colleagues from the REWE Digital SOC
• Monitor relevant information sources (such as specific technology related news, Twitter, LinkedIn and information sharing and analysis centers) to stay up to date on current attacks and trends
• Support an open feedback culture and a forward-looking error culture (learning organization)

Qualifications

• Successfully completed studies (computer science, information security, IT security, cybersecurity) or comparable hands-on training
• Certified Information Systems Security Professional (CISSP) and/or Global Information Assurance Certification (GIAC) would be a benefit and/or other similar certifications
• Knowledge of frameworks and standards in the SOC environment such as Cyber Kill Chain, MITRE or similar standards
• Technical expertise in network security, including VPN, firewall, web server security and Cloud and specific OT and IoT knowledge are considered a plus
• Understanding of Windows, Active Directory and Linux administration
• Ability to work well under pressure while maintaining a professional image and approach
• Ability to communicate complex and technical issues to diverse audiences, verbally and in writing, in an easily understood, authoritative and actionable manner
• A precise, responsible mindset, reliability and strong analytical and conceptual skills
• Highly proficient in spoken and written English and willingness to learn the local language
• Proven record in using SIEM, XDR, EDR, NDR and PAM solutions
• Technical knowledge of the products – Splunk, SentinelOne, Proofpoint, CyberArk is an advantage
• Knowledge of at least one scripting language (e. g. Python or PowerShell)

Additional Information

• Long-term, interesting and varied work for a reliable employer in a supportive team
• A family-friendly company culture with flexible working hours and remote working options available
• Staff shopping and travel discounts
• Numerous training and further development opportunities within the Group (5% of working time for self-organized training and education)
• On-site parking
• A lunch allowance
• A market-compliant, attractive and performance-related annual gross salary from EUR 70,000 with the willingness to overpay with appropriate experience and qualifications

We promote a diverse and inclusive work environment. Therefore, we welcome applications from people of different gender, age, cultural or social background, sexual identity and applications from people with disabilities. In addition, we would like to increase the proportion of women in technical professions and are particularly pleased to receive applications from women for this position.