Detection Engineer (Sekoia, German-speaking)

S-PRO; Deutschland; Remote; EUR 83,000 - 165,000; Full time

Benefits offered by this job

Flexible Schedule

Remote work model

Medical insurance

Paid vacations

Paid Sick-leaves

Paid State holidays

Job summary

S-PRO sucht erfahrenen SIEM/SOAR- und Detection-Engineering-Freelancer, um unser bestehendes SIEM-Setup weiterzuentwickeln. Sie reviewen, identifizieren Lücken und verbessern Erkennungslogik.

Sie arbeiten eigenständig, bringen Erfahrungen mit MITRE ATT&CK, Sekoia und SOC-Prozessen mit, und kommunizieren auf Deutsch. Remote in Deutschland, flexible Zusammenarbeit.

Qualifications

• Umfassende praktische Erfahrung im SIEM- und Detection-Engineering.
• Erfahrung mit SOC-Prozessen und Incident-Triage.
• Erfahrung mit SOAR und Security Automation.
• Gute Kenntnisse verschiedener Sicherheitsdatenquellen und Integrationen, insbesondere Identity, Cloud (AWS) und SaaS.
• Detection Engineering basierend auf MITRE ATT&CK.
• Erfahrung mit Versionskontrolle und nachvollziehbarer Wartung von Detections (Detections-as-Code vorteilhaft).
• Erfahrung mit Sekoia.
• Hands-on-Mentalität und selbstständiges Arbeiten.
• Kritische Analyse bestehender Setups und pragmatische Verbesserungen.
• Bereitschaft, Wissen aktiv zu teilen.
• Fließendes Deutsch.

Responsibilities

• Überprüfung und kritische Bewertung des bestehenden SIEM-/Sekoia-Setups.
• Analyse verbundener Datenquellen und Identifizierung relevanter Lücken.
• Analyse bestehender Detection Rules, Use Cases und Cases.
• Festlegung einer Baseline für Case-Volumen, Bearbeitungsaufwand und False-Positive-Rate.
• Identifizierung von Ursachen für hohen manuellen Analyseaufwand.
• Verbesserung der Erkennungslogik, Priorisierung und Fallqualität.
• Design und Implementierung zusätzlicher Datenanreicherung.
• Identifikation und Umsetzung sinnvoller Integrationen.
• Entwicklung oder Weiterentwicklung von Lösungen.

Skills

SIEM & Detection

SOC Incident Triage

SOAR & Automation

Security data sources (Identity, AWS,S

Tools

Sekoia

Job description

S-PRO is a software development and IT consulting partner. We develop unique products tailored to the client’s needs to accelerate business. Our typical engagement is consultancy, discovery, build, and maintenance, with clients from fintech, healthcare, energy and other industries.

We are looking for an experienced SIEM/SOAR and detection engineering freelancer to help further develop our existing SIEM setup.

Requirements

Responsibilities

• Review and critical evaluation of the existing Sekoia/SIEM setup
• Analysis of connected data sources and identification and resolution of relevant gaps
• Analysis of existing detection rules, use cases, and cases
• Establishment of a baseline for case volume, processing effort, and false positive rate at the start of the project
• Identification of causes for high manual analysis effort
• Improvement of detection logic, prioritization, and case quality
• Design and implementation of additional data enrichment
• Identification and implementation of meaningful integrations
• Development or further development

Requirements

• Substantial hands‑on experience with SIEM and detection engineering
• Experience with SOC processes and incident triage
• Experience with SOAR and security automation
• Strong knowledge of various security data sources and integrations, particularly identity, cloud (AWS), and SaaS
• Detection engineering based on MITRE ATT&CK
• Experience with versioned, traceable maintenance of detections (Detection-as-Code is a plus)
• Experience with Sekoia
• Hands‑on mindset and ability to work independently
• Ability to critically analyze existing setups and implement pragmatic improvements
• Willingness and ability to actively share knowledge
• Fluent in German.

What we offer

• Long team focus: we create an environment of transparent communication, and minimal bureaucracy, which leads to long-term relationships.
• Development of niche expertise: we are working in several niches, such as FinTech, healthcare, and logistics. Therefore, our employees can develop their own expertise in these domains.
• Continuous learning: we create employee development plans / personal roadmaps /quick promotion processes.
• Internal career development: 80% of our current executives were promoted to those positions within S-PRO. We encourage initiative. If a person wants to set new challenges and grow, we will definitely support them.

Benefits and perks

• Flexible schedule.
• Remote work model.
• Medical insurance
• Paid vacations
• Paid Sick-leaves.
• Paid State holidays.

By submitting your application for this position, you consent to the processing of your personal data for recruitment purposes in accordance with applicable data protection laws. Detailed information regarding the processing of personal data can be found at the following link: Сandidate Privacy