Senior Security Analyst

Tdc-Group; København, Tranbjerg; On-site; DKK 700,000 - 900,000; Full time

Job summary

TDC NET is seeking a Senior Security Analyst to lead the SIEM (Splunk Enterprise Security) for its Cyber Defense team. You will own the SIEM application, define roadmaps, coordinate with the engineering group, and drive improvements across data coverage and detection workflows.

You will mentor analysts, validate detections with testing, and act as interim technical lead during major incidents while maintaining required SECRET-level clearance.

Qualifications

• 3–5+ years of security analyst experience.
• Strong SIEM experience and threat detection capabilities.
• Ability to translate operational needs into clear priorities and actions.

Responsibilities

• Own the SIEM application for the Cyber Defense team, defining its roadmap and coordinating delivery with the engineering team.
• Assess gaps in SIEM capabilities, data coverage and workflows; create a prioritized improvement plan with measurable outcomes.
• Maintain investigation dashboards, reusable searches, and security context with threat intel and asset identity data.
• Define logging and data requirements; verify delivered data contains necessary fields, timestamps, and context.
• Act as technical lead for SIEM analysis during major incidents and coordinate with incident responders.
• Mentor analysts in SIEM use, alert analysis, and detection content tuning.
• Validate detections with security testing through attack simulations and purple team exercises.

Skills

SIEM operation

Splunk Enterprise Security

Threat intel

Incident response

Log analysis

MITRE ATT&CK

Analytical thinking

Education

Bachelor's degree in Cyber Security or related field

Tools

Splunk ES

Job description

Senior Security Analyst

SIEM Lead in the Cyber Defense team

As SIEM Lead, you will be the owner of our SIEM application (Splunk Enterprise Security) used by TDC NET’s Cyber Defense team. Your work will help analysts detect and investigate threats across our IT systems and Denmark’s critical telecommunications infrastructure.

About the job

Your focus will be the SIEM application, its detections and the workflows analysts use every day. A dedicated engineering team in another department operates the underlying platform. You will work with that team on security data requirements and with the Head of Analysts to prioritize improvements.

Our work is guided by threat intelligence. The wider Cyber Defense team covers detection and response, threat hunting, detection engineering, incident response and forensics, penetration testing and red teaming, vulnerability management, anti-abuse and security postmaster services.

Your responsibilities

• Own the SIEM application for the Cyber Defense team, defining its roadmap and priorities with the Head of Analysts and coordinating delivery with the engineering team.


• Assess gaps in SIEM capabilities, data coverage and investigation workflows, and turn findings into a prioritized improvement plan. Track progress through measures of coverage and alert quality.


• Maintain investigation dashboards, reusable searches and security context, including threat intelligence and asset and identity information used to enrich alerts.


• Define logging and data requirements for the engineering team. Validate that delivered data contains the fields, timestamps and context needed for detection and investigation.


• Act as the technical lead for SIEM analysis during major incidents, coordinating with incident response colleagues.


• Mentor analysts in SIEM use, alert analysis and investigation techniques, and review detection content and tuning decisions with the team.


• Validate detections with the Security Testing team through attack simulations and purple team exercises and follow up on missed or incomplete alerts.

Our Cyber Defense team is Trusted Introducer certified, and our Security Testing team is CREST certified.

You will join approximately 45 colleagues in TDC NET Security, with an open, informal working culture where people share knowledge and challenge ideas.

The Cyber Defense team operates a 24/7 on-call rotation. As Senior Security Analyst, you will participate in this rotation, investigating and responding to security incidents outside normal working hours.

About you

You are an experienced (3-5+ years of experience) security analyst with solid practical SIEM knowledge and the ability to turn operational needs into clear priorities. You can make sound decisions with incomplete information, coordinate technical analysis under pressure and communicate findings and uncertainty clearly to both technical and non-technical colleagues.

We are looking for experience in the following areas:

• Working with SIEM capabilities, data flows, integrations and application configuration in a production SOC or Cyber Defense environment.


• Taking ownership of a SIEM application, assessing gaps and defining a practical, prioritized roadmap in collaboration with analysts and platform engineers.


• Investigating incidents and hunting for threats using endpoint, identity, network and application logs, with an understanding of data quality and normalization.


• Using threat intelligence and MITRE ATT&CK to define detection requirements and identify gaps in coverage.


• Translating security needs into clear requirements for engineers and providing practical guidance to less experienced analysts.


• Understanding offensive techniques such as exploitation, privilege escalation and lateral movement, and the evidence they leave in logs.


• Using penetration tests, red team findings or purple team exercises to validate detections and close monitoring gaps.


• You must be able to maintain security clearance at HEMMELIGT (SECRET) level throughout your employment.

Experience with scripting, automation and version control is welcome.

Relevant higher education and security certifications are also welcome.

Contact:

If you have questions about the position or want to know moreabout what it means to work at TDC NET, feel free to reach out to Cyber Defense Director Cristiano Iria at [e-mail]

We look forward to reviewing your application and potentially welcoming you to our team at TDC NET.

Location:

Teglholmsgade 1, Købehavn or Sletvej 30, Aarhus

We encourage you not to include a photo in your CV or cover letter. In TDC NET we are dedicated to fostering an inclusive culture that values diversity, and we pride ourselves on providing equal opportunities for everyone.

All qualified candidates will be assessed regardless of ethnicity, religion, gender, gender identity, sexual orientation, disability and all the other characteristics that make us different.

No later than 30 November2026.

TDC NET - lots of benefits

• Engage in meaningful work The green transition needs a strong digital infrastructure. With usyou will take part in delivering the technological solutions. Forall of us.


• We provide the working life of the future Weset targets for a healthy and safe working environment. Our work culture is digital and flexible when compatible with tasksand colleagues. Welcome to your new hybrid workplace.


• Development through challenges - get lots of responsibility from day one Get responsibility quickly and be a part of the biggest transformation in our field - ever. Bechallenged.


• Become part of a strong network Takepart in connecting Denmark together with both new and experiencedcolleagues and many various professional competencies. InTDC NET we are both motivated and united by a strong network.

Our values

#LI-POST #TDCNET