Cyber Defense Analyst: Threat Hunter & Incident Response

Who is Hiring; Zürich; On-site; CHF 110,000 - 150,000; Full time

Job summary

The University of Zurich is seeking an IT Security Analyst for the Cyber Defence Center to strengthen operational cyber security and drive detection, analysis, and response capabilities.

You will handle security alerts, conduct threat hunting, and develop detection rules using Microsoft Defender XDR, Defender for Endpoint, and KQL, while collaborating on vulnerability management and incident response.

Qualifications

• Completed degree in computer science, cyber security or a comparable qualification.
• Practical professional experience in security operations, SOC, CDC, incident response, or IT security.
• Very good knowledge of SIEM systems, security logs, and detection use cases.
• Good knowledge of the Microsoft security platform (Defender XDR, Defender for Endpoint, Microsoft 365 Security).
• Experience with KQL for analyzing events; exposure and vulnerability management.
• Strong knowledge in network, endpoint, identity, and cloud security; handling IOC and incidents.
• Scripting skills (PowerShell, Python, Bash) are an advantage.
• Analytical and communicative, with good German and English skills.

Responsibilities

• Analyze, triage, and handle security alerts and incidents from SIEM, Defender XDR, endpoints, networks, identity, cloud, and other sources.
• Perform in-depth analyses and threat hunting using Advanced Hunting and KQL.
• Correlate events across systems; investigate suspicious activity and initiate incident response measures.
• Block and manage IOC data such as IPs, domains, URLs, or hashes.
• Develop detection, hunting, and response use cases in SIEM and Microsoft security stack.
• Create and optimize KQL queries, rules, and automation; collaborate on vulnerability management.
• Document incidents and analyses; contribute to IT security reporting.

Skills

Security operations

SIEM

Threat hunting

KQL

PowerShell

Python

Bash

Microsoft Defender XDR

Defender for Endpoint

Microsoft 365 Security

Advanced Hunting

Vulnerability management

IOC handling

Analytical thinking

German and English

Education

Bachelor's degree in computer science, cyber security or equivalent

Tools

SIEM systems

Microsoft Defender XDR

Defender for Endpoint

Microsoft 365 Security

KQL (Kusto Query Language)

Job description

The University of Zurich is seeking an IT Security Analyst for the Cyber Defence Center to strengthen operational cyber security and drive detection, analysis, and response capabilities.

You will handle security alerts, conduct threat hunting, and develop detection rules using Microsoft Defender XDR, Defender for Endpoint, and KQL, while collaborating on vulnerability management and incident response.