Security Incident Engineer - Detect, Respond & Harden Endpoints

Caisse Des Medecins; Genf; Vor Ort; CHF 120.000 - 180.000; Vollzeit

Zusammenfassung

Ärztekasse Genossenschaft seeks experienced security engineers to triage and resolve Defender alerts, detect and respond to incidents, and lead remediation with engineering and operations teams.

Role involves tuning rules, developing playbooks, monitoring events, and conducting post-incident reviews. 80-100% pensum, immediate start, Geneva/Zurich area, on-site. English required; German/French a plus.

Qualifikationen

• 3+ years of experience in security incident response, SOC or a similar role.
• Hands-on experience with Microsoft Defender for Endpoint (EDR) and endpoint security.
• Strong understanding of security monitoring, SIEM and detection engineering.
• Knowledge of attack techniques and incident handling frameworks (e.g. NIST, MITRE ATT&CK).

Aufgaben

• Triage, investigate and resolve endpoint security alerts from Microsoft Defender across employee machines.
• Detect, analyse and respond to security incidents across endpoints, infrastructure and applications.
• Lead incident response activities and coordinate remediation with engineering and operations teams.
• Tune detection rules to reduce false positives and continuously improve alert quality.
• Develop and maintain incident response playbooks, processes and tooling.
• Monitor security events and alerts (Microsoft Defender, SIEM, IDS/IPS) and drive continuous detection improvements.
• Conduct post-incident reviews and root-cause analysis, and track corrective actions.
• Implement security best practices and harden systems against emerging threats.
• Participate in future on-call rotation.

Kenntnisse

Security incident response

Endpoint security

SIEM & detection engineering

NIST & MITRE ATT&CK

Windows security

Linux security

Kubernetes (plus)

Scripting (Bash, Python, Go)

English communication

Analytical mindset

Ausbildung

None

Tools

Kubernetes

Jobbeschreibung

Ärztekasse Genossenschaft seeks experienced security engineers to triage and resolve Defender alerts, detect and respond to incidents, and lead remediation with engineering and operations teams.

Role involves tuning rules, developing playbooks, monitoring events, and conducting post-incident reviews. 80-100% pensum, immediate start, Geneva/Zurich area, on-site. English required; German/French a plus.