Senior SIEM Lead: Threat Detection & Incident Response

TDC A/S; København; On-site; DKK 900,000 - 1,200,000; Full time

Benefits offered by this job

Engage in meaningful work

Hybrid workplace

Development through challenges

Strong network

Job summary

TDC NET is seeking a Senior Security Analyst to own the SIEM (Splunk Enterprise Security) for the Cyber Defense team. You will drive the SIEM roadmap, ensure data quality, and lead investigations during incidents to protect Denmark's critical telecom infrastructure.

You will mentor analysts, coordinate with platform engineers, and use threat intelligence to improve detections. The role includes a 24/7 on-call rotation and a hybrid work setup, located at Teglholmsgade 1, København or in Aarhus.

Qualifications

• Experience with SIEM in production SOC or Cyber Defense environment.
• Ownership of SIEM application roadmap and priorities with analysts.
• Investigating incidents and hunting for threats across logs.
• Using threat intelligence and MITRE ATT&CK to define detection requirements.
• Translating security needs into engineer requirements and guidance.
• Understanding offensive techniques and log evidence.
• Using pentests, red/purple team exercises to validate detections.
• Ability to maintain SECRET level clearance.

Responsibilities

• Own the SIEM application for the Cyber Defense team and define its roadmap.
• Assess gaps in SIEM capabilities, data coverage and workflows; define a prioritized plan.
• Maintain investigation dashboards, reusable searches, and security context.
• Define logging and data requirements; validate data contains needed fields and context.
• Lead SIEM analysis during major incidents with incident response colleagues.
• Mentor analysts in SIEM use and review detections with the team.
• Validate detections with Security Testing via attack simulations and purple team exercises.

Skills

SIEM

Threat intelligence

Incident response

Threat hunting

MITRE ATT&CK

Detection engineering

Red team & purple team

Security clearence awareness

Tools

Splunk Enterprise Security

Job description

TDC NET is seeking a Senior Security Analyst to own the SIEM (Splunk Enterprise Security) for the Cyber Defense team. You will drive the SIEM roadmap, ensure data quality, and lead investigations during incidents to protect Denmark's critical telecom infrastructure.

You will mentor analysts, coordinate with platform engineers, and use threat intelligence to improve detections. The role includes a 24/7 on-call rotation and a hybrid work setup, located at Teglholmsgade 1, København or in Aarhus.