IT security engineer for incident response

getolo GmbH; Berlin; Hybrid; EUR 70,000 - 100,000; Full time

Benefits offered by this job

Hybrid work model

1–2 days in Berlin office

30 days vacation pro-rated?

Job summary

getolo GmbH ищет IT Security Engineer, ответственного за полный цикл операций кибербезопасности. Вы будете руководить SIEM/EDR, внедрять SOAR и управлять инцидентами с координацией между IT, инженерией и бизнесом.

Требуется 4+ года hands-on в безопасности, знание ISO 27001 или эквивалентных фреймворков, владение скриптами (Python/PowerShell). Вакансия гибридная, 1–2 дня в офисе в Берлине, конкурентная фиксированная оплата и льготы.

Qualifications

• 4+ лет в операциях безопасности, SOC или аналогичной роли
• Практический опыт работы с SIEM: подключение источников, настройка детекций, расследования
• Опыт оркестрации и реагирования с помощью SOAR
• Опыт работы с EDR и MDM-управляемыми конторифузиями (macOS и Windows)
• Умение управлять уязвимостями: сканирование, приоритизация, слежение за remediation
• Знание ISO 27001 или аналогичных фреймворков (NIST, CIS, DORA) и как контроли применяются к повседневной деятельности
• Скрипты для автоматизации (Python, PowerShell, Unix shell)
• Умение ясно объяснять риски не-специалистам и писать для руководства
• Опыт работы в облачных стэках SaaS/PaaS
• Свободное владение английским

Responsibilities

• Ведение и постоянное улучшение SIEM: подключение источников, настройка детекций, калибровка сигналов
• Автоматизация реагирования с использованием SOAR
• Эксплуатация защиты на рабочих местах (EDR)
• Обработка тревог, эскалации и управление инцидентами
• Руководство управлением инцидентами от обнаружения до ликвидации и постинцидентного анализа
• Обнаружение и устранение конфигурационных дрейфов
• Контроль уязвимостей: сканирование, приоритизация, координация remediation
• Планирование тестов на проникновение и внедрение remediation
• Участие в лучшей практике безопасности для инфраструктуры, конечных точек, идентификации и SaaS
• Ввод дизайна безопасности в новые системы на ранних стадиях
• Выступать в роли консультанта по безопасности IT, инженерии и бизнесу
• Вклад в политику безопасности, рисковый реестр и дизайн контроля
• Помощь в аудиторских проверках и сборе доказательств
• Обучение сотрудников основам кибербезопасности
• Участие в аудитах (ISO27001/SOC2) и вендорских оценках
• Доставлять оперативные данные руководству по безопасности и KPI

Skills

SIEM operations

SOAR

EDR

MDM

Incident response

Vulnerability management

ISO 27001 / NIST / CIS

Scripting (Python/PowerShell)

Cloud security

English fluency

Tools

SOAR

EDR

MDM

Python

PowerShell

Job description

Описание: Support us in designing the insurance experience of the future. As an IT Security Engineer you own IT Security Operations at getolo end to end: running our detection and response capability day to day, keeping endpoints and infrastructure hardened, and driving incidents, vulnerabilities and findings to closure. Security operations is the core of this role. Beyond it, you bring an operator's perspective into how we design systems and into our governance work, to ensure control effectiveness.

Задачи:

• Run and continuously improve our SIEM: log source onboarding, detection rules, tuning, alert quality
• Automate orchestration and response with SOAR
• Operate endpoint protection across our fleet
• Triage and manage alerts, driving them to closure or escalation
• Lead incident management from detection through containment, recovery and post-incident review
• Detect and remediate configuration drift against hardening baselines; run technical audits
• Oversee vulnerability management: scanning, prioritisation, and remediation tracking with IT and engineering
• Plan and coordinate penetration tests (internal and with external providers) and drive remediation
• Contribute to security best practices and standards for infrastructure, endpoints, identity and SaaS
• Bring security design input into new systems and projects early
• Act as a security advisor to IT, engineering and the wider business
• Feed operational reality into security policies, the risk register and control design
• Support internal and external audits with evidence collection and remediation of findings
• Contribute to security awareness trainings
• Support third-party and vendor security assessments
• Deliver operational input for management reporting on security posture, KPIs and incidents

Требования:

• 4+ years in security operations, SOC, blue team or a comparable hands-on security role
• Hands-on SIEM experience: onboarding sources, writing and tuning detections, running investigations
• Knowledge of orchestration and response with SOAR
• Solid experience with EDR and MDM-managed endpoint fleets (macOS and Windows)
• Practical incident response experience and the composure to lead an incident
• Vulnerability management from scanning through remediation, including pentest coordination
• Working knowledge of ISO 27001 or comparable frameworks (Grundschutz, NIST CSF, CIS Controls, DORA) and how controls map to daily operations
• Scripting for automation (Python, PowerShell, Unix shell)
• Clear communicator who can explain risk to non-security stakeholders and write for management
• Experience with cloud first tech stacks running on SaaS and PaaS
• Fluent English
• Будет плюсом: Certifications such as GCIH, GCIA, CISSP or Security+; Cloud and identity security experience (e.g. Microsoft 365 / Entra ID, AWS or GCP); Detection engineering or threat hunting background; Prior involvement in audits (ISO 27001, SOC2 or similar)

Условия:

• This is a full-time hybrid role, with 1-2 days per week working from our Berlin office.
• Attractive fixed salary
• Start with 28 vacation days, with an increase every two years (capped at 30 days).
• Holidays on December 24th and 31st
• Choose between a free Swapfiets bike, or a Berlin/Brandenburg ticket ("VBB - Jobticket") or BVG "Deutschlandticket" subsidized by us
• Work hybrid - from your home office or in our office in Berlin-Mitte
• Work abroad in the EU for up to 60 days
• Benefit from free coaching sessions with nilo.health, our mental health tool
• Test our products yourself!
• Choose between dentolo, petolo or vitolo
• Learning Budget starting from 750 € per year
• Regular (360 degree) feedback
• We communicate, collaborate, and celebrate in English to ensure everyone is included
• Legendary summer and winter parties
• Regular team events
• Many discounts on the corporate Benefits Platform
• Two Community Days per calendar year
• Pet friendly office