Incident Response Engineer - Create & Lead Security Playbooks

Ärztekasse Genossenschaft; Thônex; Vor Ort; CHF 120.000 - 180.000; Vollzeit

Zusammenfassung

Ärztekasse Genossenschaft is renewing its datacenter and we are looking for smart and experienced engineers to contribute and shape clever and creative solutions for a meaningful industry. The role focuses on security incident response and proactive threat detection in a modern, agile environment.

You will triage Defender for Endpoint alerts, lead incident response, tune detections, develop playbooks, and collaborate with cross-functional teams in Geneva or Zurich.

Qualifikationen

• 3+ years of experience in security incident response, SOC or a similar role.
• Hands-on experience with Microsoft Defender for Endpoint (EDR) and endpoint security.
• Strong understanding of security monitoring, SIEM and detection engineering.
• Knowledge of attack techniques and incident handling frameworks (e.g. NIST, MITRE ATT&CK).
• Experience with Windows and Linux security; Kubernetes is a plus.
• Scripting and automation skills, preferably in Bash, Python or Go.
• Relevant certifications (e.g. GCIH, GCIA, OSCP) are a plus.
• Analytical, calm under pressure and a strong communicator; English required, German and French a plus.

Aufgaben

• Triage, investigate and resolve endpoint security alerts from Microsoft Defender across employee machines.
• Detect, analyse and respond to security incidents across our endpoints, infrastructure and applications.
• Lead incident response activities and coordinate remediation with engineering and operations teams.
• Tune detection rules to reduce false positives and continuously improve alert quality.
• Develop and maintain incident response playbooks, processes and tooling.
• Monitor security events and alerts (Microsoft Defender, SIEM, IDS/IPS) and drive continuous detection improvements.
• Conduct post-incident reviews and root-cause analysis, and track corrective actions.
• Implement security best practices and harden systems against emerging threats.
• Participate in future on-call rotation.

Kenntnisse

Security incident response

Defender for Endpoint

SIEM

Detection engineering

Threat frameworks

Windows security

Linux security

Kubernetes

Scripting (Bash)

Python

Go

Certifications

English

German

French

Jobbeschreibung

Ärztekasse Genossenschaft is renewing its datacenter and we are looking for smart and experienced engineers to contribute and shape clever and creative solutions for a meaningful industry. The role focuses on security incident response and proactive threat detection in a modern, agile environment.

You will triage Defender for Endpoint alerts, lead incident response, tune detections, develop playbooks, and collaborate with cross-functional teams in Geneva or Zurich.