Senior Security Analyst

TDC A/S; København; On-site; DKK 900,000 - 1,200,000; Full time

Benefits offered by this job

Engage in meaningful work

Hybrid workplace

Development through challenges

Strong network

Job summary

TDC NET is seeking a Senior Security Analyst to own the SIEM (Splunk Enterprise Security) for the Cyber Defense team. You will drive the SIEM roadmap, ensure data quality, and lead investigations during incidents to protect Denmark's critical telecom infrastructure.

You will mentor analysts, coordinate with platform engineers, and use threat intelligence to improve detections. The role includes a 24/7 on-call rotation and a hybrid work setup, located at Teglholmsgade 1, København or in Aarhus.

Qualifications

• Experience with SIEM in production SOC or Cyber Defense environment.
• Ownership of SIEM application roadmap and priorities with analysts.
• Investigating incidents and hunting for threats across logs.
• Using threat intelligence and MITRE ATT&CK to define detection requirements.
• Translating security needs into engineer requirements and guidance.
• Understanding offensive techniques and log evidence.
• Using pentests, red/purple team exercises to validate detections.
• Ability to maintain SECRET level clearance.

Responsibilities

• Own the SIEM application for the Cyber Defense team and define its roadmap.
• Assess gaps in SIEM capabilities, data coverage and workflows; define a prioritized plan.
• Maintain investigation dashboards, reusable searches, and security context.
• Define logging and data requirements; validate data contains needed fields and context.
• Lead SIEM analysis during major incidents with incident response colleagues.
• Mentor analysts in SIEM use and review detections with the team.
• Validate detections with Security Testing via attack simulations and purple team exercises.

Skills

SIEM

Threat intelligence

Incident response

Threat hunting

MITRE ATT&CK

Detection engineering

Red team & purple team

Security clearence awareness

Tools

Splunk Enterprise Security

Job description

Senior Security Analyst

SIEM Lead in the Cyber Defense team

As SIEM Lead, you will be the owner of our SIEM application (Splunk Enterprise Security) used by TDC NET’s Cyber Defense team. Your work will help analysts detect and investigate threats across our IT systems and Denmark’s critical telecommunications infrastructure.

About the job

Your focus will be the SIEM application, its detections and the workflows analysts use every day. A dedicated engineering team in another department operates the underlying platform. You will work with that team on security data requirements and with the Head of Analysts to prioritize improvements.

Our work is guided by threat intelligence. The wider Cyber Defense team covers detection and response, threat hunting, detection engineering, incident response and forensics, penetration testing and red teaming, vulnerability management, anti-abuse and security postmaster services.

Your responsibilities

• Own the SIEM application for the Cyber Defense team, defining its roadmap and priorities with the Head of Analysts and coordinating delivery with the engineering team.


• Assess gaps in SIEM capabilities, data coverage and investigation workflows, and turn findings into a prioritized improvement plan. Track progress through measures of coverage and alert quality.


• Maintain investigation dashboards, reusable searches and security context, including threat intelligence and asset and identity information used to enrich alerts.


• Define logging and data requirements for the engineering team. Validate that delivered data contains the fields, timestamps and context needed for detection and investigation.


• Act as the technical lead for SIEM analysis during major incidents, coordinating with incident response colleagues.


• Mentor analysts in SIEM use, alert analysis and investigation techniques, and review detection content and tuning decisions with the team.


• Validate detections with the Security Testing team through attack simulations and purple team exercises and follow up on missed or incomplete alerts.

Our Cyber Defense team is Trusted Introducer certified, and our Security Testing team is CREST certified.

You will join approximately 45 colleagues in TDC NET Security, with an open, informal working culture where people share knowledge and challenge ideas.

The Cyber Defense team operates a 24/7 on-call rotation. As Senior Security Analyst, you will participate in this rotation, investigating and responding to security incidents outside normal working hours.

About you

You are an experienced (3-5+ years of experience) security analyst with solid practical SIEM knowledge and the ability to turn operational needs into clear priorities. You can make sound decisions with incomplete information, coordinate technical analysis under pressure and communicate findings and uncertainty clearly to both technical and non-technical colleagues.

We are looking for experience in the following areas:

• Working with SIEM capabilities, data flows, integrations and application configuration in a production SOC or Cyber Defense environment.


• Taking ownership of a SIEM application, assessing gaps and defining a practical, prioritized roadmap in collaboration with analysts and platform engineers.


• Investigating incidents and hunting for threats using endpoint, identity, network and application logs, with an understanding of data quality and normalization.


• Using threat intelligence and MITRE ATT&CK to define detection requirements and identify gaps in coverage.


• Translating security needs into clear requirements for engineers and providing practical guidance to less experienced analysts.


• Understanding offensive techniques such as exploitation, privilege escalation and lateral movement, and the evidence they leave in logs.


• Using penetration tests, red team findings or purple team exercises to validate detections and close monitoring gaps.


• You must be able to maintain security clearance at HEMMELIGT (SECRET) level throughout your employment.

Experience with scripting, automation and version control is welcome.

Relevant higher education and security certifications are also welcome.

Contact:

If you have questions about the position or want to know moreabout what it means to work at TDC NET, feel free to reach out to Cyber Defense Director Cristiano Iria at [e-mail]

We look forward to reviewing your application and potentially welcoming you to our team at TDC NET.

Location:

Teglholmsgade 1, Købehavn or Sletvej 30, Aarhus

We encourage you not to include a photo in your CV or cover letter. In TDC NET we are dedicated to fostering an inclusive culture that values diversity, and we pride ourselves on providing equal opportunities for everyone.

All qualified candidates will be assessed regardless of ethnicity, religion, gender, gender identity, sexual orientation, disability and all the other characteristics that make us different.

No later than 30 November2026.

TDC NET - lots of benefits

• Engage in meaningful work The green transition needs a strong digital infrastructure. With usyou will take part in delivering the technological solutions. Forall of us.


• We provide the working life of the future Weset targets for a healthy and safe working environment. Our work culture is digital and flexible when compatible with tasksand colleagues. Welcome to your new hybrid workplace.


• Development through challenges - get lots of responsibility from day one Get responsibility quickly and be a part of the biggest transformation in our field - ever. Bechallenged.


• Become part of a strong network Takepart in connecting Denmark together with both new and experiencedcolleagues and many various professional competencies. InTDC NET we are both motivated and united by a strong network.

Our values

#LI-POST #TDCNET