Security Operations Engineer

Revizto; Deutschland; On-site; EUR 70,000 - 100,000; Full time

Job summary

Revizto is seeking a Security Operations Engineer to protect its cloud infrastructure, endpoints, and SaaS environments. You will own security incidents from detection through remediation, coordinating with Engineering, DevOps, and IT to improve detection capabilities and reduce response times.

You will implement and refine detection across AWS, Azure, and Kubernetes, document runbooks, and collaborate to strengthen the company's security posture.

Qualifications

• 3+ years in SOC, IR, or security detection role.
• Experience with SIEM/EDR—Sentinel and CrowdStrike preferred.
• Experience with writing security queries in KQL or similar.

Responsibilities

• Monitor security alerts across cloud, endpoints, and SaaS.
• Lead incident response activities including containment and recovery.
• Develop detection rules aligned with MITRE ATT&CK.
• Threat hunt across cloud, endpoints, and identity telemetry.
• Analyze logs from AWS, Azure/Entra ID, Kubernetes, and SaaS.
• Maintain incident response runbooks and documentation.

Skills

SOC

Incident Response

SIEM (Microsoft Sentinel)

EDR (CrowdStrike Falcon)

KQL queries

MITRE ATT&CK

Cloud security (AWS/Azure)

English proficiency (B2+)

Tools

CrowdStrike Falcon

Microsoft Sentinel

KQL tooling

AWS/Azure security tooling

Job description

Revizto enables the people behind the world's most important structures to do their best work. We connect architects, engineers, contractors, and owners in one shared 2D/3D environment to help deliver complex projects on time and on budget. From airports and hospitals to data centers and large-scale infrastructure, Revizto supports industry leaders in reducing risk, improving collaboration, and delivering better project outcomes. Built on a gaming engine, Revizto is designed to handle the scale and complexity of modern construction projects while remaining fast, reliable, and accessible across devices and environments - whether teams are in the office or on site.

Key Responsibilities & Requirements

• Security Monitoring & Investigation: Monitor, triage, and investigate security alerts and incidents across cloud, endpoint, and SaaS environments, ensuring timely identification and assessment of potential threats.
• Incident Response Management: Lead and coordinate security incident response activities, including containment, eradication, recovery, root-cause analysis, and preparation of comprehensive post-incident reports.
• Threat Detection Engineering: Develop, test, and continuously refine security detection rules to improve accuracy, reduce false positives, and maintain detection coverage aligned with the MITRE ATT&CK framework.
• Proactive Threat Hunting: Conduct proactive threat-hunting activities across cloud, endpoint, and identity telemetry to identify suspicious behavior, emerging threats, and potential security compromises.
• Security Log Analysis: Analyze and correlate security logs and telemetry from AWS, Microsoft Azure/Entra ID, Kubernetes, endpoints, and SaaS applications to detect and investigate potential security incidents.
• Cloud Security & Vulnerability Management: Investigate cloud security findings and vulnerability alerts, collaborate with relevant system owners, and support timely remediation of identified security risks.
• Security Logging & Visibility: Maintain the health, completeness, and reliability of existing security log sources while identifying and onboarding additional sources to improve monitoring and detection coverage.
• Incident Response Documentation: Develop, maintain, and continuously improve incident response runbooks and escalation procedures to ensure consistent and effective handling of security events.

Requirements

• Professional Experience: At least 3 years of hands-on experience in a Security Operations Center (SOC), incident response, or security detection role.
• SIEM & EDR Technologies: Practical experience working with Security Information and Event Management (SIEM) solutions, preferably Microsoft Sentinel, and Endpoint Detection and Response (EDR) platforms, preferably CrowdStrike Falcon.
• Detection Engineering & Query Languages: Ability to write, analyze, optimize, and tune security detection queries using Kusto Query Language (KQL) or similar query languages.
• Cybersecurity Fundamentals: Solid understanding of common cyberattack techniques, threat behaviors, and the MITRE ATT&CK framework, combined with a strong foundation in AWS and Azure cloud security principles.
• End-to-End Incident Response: Proven experience managing security incidents throughout their entire lifecycle, from initial alert investigation and triage through containment, eradication, recovery, root-cause analysis, and post-incident reporting.
• Security Frameworks & Standards: Knowledge of established information security frameworks and standards, including ISO 27001, NIST, CIS, and SOC 2.
• English Proficiency: Upper-intermediate (B2) or higher proficiency in English, both written and spoken.

Preferred Qualifications

• Hands-on experience conducting proactive threat-hunting activities to identify and investigate potential security threats.
• Knowledge of Kubernetes and container security principles, including common risks and security considerations in containerized environments.
• Basic scripting skills in Python, PowerShell, or Bash to support security investigations, analysis, and operational tasks.
• One or more relevant professional certifications, such as GCIH, GCIA, GCFA, GCTI, Microsoft SC-200, or CrowdStrike CCFA/CCFH.

Personal & Professional Competencies

• Composure Under Pressure: Ability to remain calm, structured, and focused when managing security incidents and working under time-sensitive conditions.
• Communication & Reporting: Strong written communication skills, with the ability to clearly explain security incidents, technical findings, and their impact to both engineering teams and executive stakeholders.
• Collaboration & Ownership: A proactive team player who can work effectively both independently and collaboratively, take ownership of responsibilities, and continuously identify opportunities to improve security processes.
• Relationship Building: Ability to establish and maintain strong, productive working relationships with colleagues across teams and at all organizational levels.

Position Overview

We are looking for a Security Operations Engineer to join our Information Security team and play a key role in protecting Revizto 's cloud infrastructure, endpoints, and SaaS environments. In this role, you will be at the forefront of identifying, investigating, and responding to security threats, ensuring that potential risks are detected and addressed effectively. You will take ownership of security incidents throughout their lifecycle, continuously improve threat detection capabilities, and proactively identify vulnerabilities and emerging threats. Working closely with Engineering, DevOps, and IT teams, you will contribute to strengthening our overall security posture, enhancing detection coverage, and reducing incident detection and response times. This is an opportunity to take ownership of meaningful security challenges and directly contribute to the protection and resilience of Revizto 's technology environment.

Why Join Us

Recognised as one of Switzerland's Best Managed Companie