Cyber Defense Analyst — Threat Hunting & Incident Response

Swissgrid AG; Aarau; Vor Ort; CHF 110.000 - 150.000; Vollzeit

Benefits dieser Stelle

Flexible working hours

Training support

Near Aarau station

Zusammenfassung

Swissgrid AG in Aarau seeks a Cyber Security Analyst to join the Cyber Defense Center and protect the Swiss electricity grid. You will apply threat modelling, develop SIEM use cases, and coordinate countermeasures during security incidents.

You will analyze threats, lead incident response efforts, and collaborate with SOCs and CERTs across critical infrastructure, including on-call rotations throughout the year.

Qualifikationen

• At least 3–4 years of hands-on experience as a SOC Analyst or Incident Responder.
• Degree in Information Security, Information Technology, or a related field.
• Understanding of industrial control systems (ICS); knowledge of substations is a plus.
• Familiar with SIEM, EDR, or NDR technologies.
• Strong incident analysis and triage capabilities.
• Experience with scripting languages (PowerShell, Bash, Python).

Aufgaben

• Join the Cyber Defense Center and contribute to its evolution.
• Perform threat modelling and create new SIEM use cases.
• Analyze attacks, develop countermeasures, and coordinate responses during security incidents.
• Further develop the incident response process.
• Conduct forensic analyses and threat hunting on compromised systems.
• Stay updated on the global threat landscape in energy sectors.
• Lead engineering projects and improve or introduce tools.
• Maintain communication with SOCs and CERTs of other critical infrastructure operators and authorities.
• Participate in on‑call duty (6–8 weeks per year).

Kenntnisse

SOC Analyst experience

Incident response

Threat hunting

English fluency

Ausbildung

Degree in Information Security/IT

Tools

PowerShell

Bash

Python

Jobbeschreibung

Swissgrid AG in Aarau seeks a Cyber Security Analyst to join the Cyber Defense Center and protect the Swiss electricity grid. You will apply threat modelling, develop SIEM use cases, and coordinate countermeasures during security incidents.

You will analyze threats, lead incident response efforts, and collaborate with SOCs and CERTs across critical infrastructure, including on-call rotations throughout the year.