Cyber Defense & Incident Response

Delivery Hero; España; On-site; EUR 55,000 - 75,000; Full time

Benefits offered by this job

Health insurance

Glovo credit

Transportation discounts

Gym membership

Time off: work from home 2 days/week

Work from anywhere up to 3 weeks/year

Parental leave

Nursery at office

Online therapy and wellbeing

Job summary

Glovo is seeking a CSIRT Engineer to join our Cyber Defense team. You will be the shield of Glovo, defending our ecosystem with proactive threat hunting, high-level automation, and sophisticated detection engineering.

Responsibilities include incident response, building playbooks, tuning alerts, and improving SIEM/SOAR tooling, while collaborating to maintain full visibility across Glovo.

Qualifications

• Experience in Incident Response and Digital Forensics is a plus.
• Desirable operational experience with AWS and cloud-native logs.
• Proficiency in Python (or Golang) to automate responses and build tooling.
• Knowledge of threat monitoring and fine-tuning alerts (detection engineering).
• Curiosity to learn Threat Hunting and MITRE ATT&CK framework; strong communication skills.

Responsibilities

• Be the First Responder: support DFIR efforts and investigations.
• Architect Readiness: design and maintain playbooks and methodologies.
• Precision Monitoring: create and tune alerts with high fidelity, low noise.
• Automate & Orchestrate: build tooling for incident response to reduce manual toil.
• Hunt the Threat: research threats and perform threat-hunting across infrastructure.
• Manage the Pipeline: coordinate log ingestion tools and SIEM visibility.

Skills

Incident Response

Digital Forensics

AWS

Python

Golang

Threat Hunting

MITRE ATT&CK

Communication

Tools

SIEM

SOAR

Job description

Job Description

If you're here, it's because you're looking for an exciting ride.

A ride that will fuel up your ambitions to take on a new challenge and stretch yourself beyond your comfort zone. We'll deliver a non-vanilla culture built on talent, where we work to amplify the impact on millions of people, paving the way forward together.

Mission

Glovo's success and constant growth introduce complex challenges in defending our ecosystem. We are looking for a CSIRT Engineer to join our Cyber Defense team. Your mission is to be the shield of Glovo, ensuring we are not just ready to respond to threats, but proactive enough to hunt them down before they arrive. You will be a key player in building a "SOCless" future through high-level automation and sophisticated detection engineering.

The Journey

• Be the First Responder: Support Digital Forensics and Incident Response (DFIR) efforts, conducting deep-dive investigations into security breaches and anomalies following the Cyber Incident Response Cycle.
• Architect Readiness: Design and maintain the playbooks and investigation methodologies that ensure Glovo is prepared for any security incident.
• Precision Monitoring: Create, validate, and fine-tune alerts to ensure high fidelity and low noise, turning raw logs into actionable intelligence.
• Automate & Orchestrate: Contribute our "SOCless" ambition by building tooling and automation for incident response, reducing manual toil through smart orchestration.
• Hunt the Threat: Proactively "play the bad guy" by researching emerging threats and conducting threat-hunting exercises across our infrastructure.
• Manage the Pipeline: Cooperate with the management of our security log ingestion tools and SIEM to ensure full visibility across Glovo.

Qualifications

• The Responder's Mindset: Experience in Incident Response and Digital Forensics it's a plus.
• Cloud Proficiency: Desirable operational experience with AWS; you know how to track an adversary through cloud-native logs.
• Coding Skills: Experience in Python (or Golang) to automate responses and build custom security tooling.
• Detection Engineering: A knack for threat monitoring and fine-tuning alerts to find the needle in the haystack.
• Proactivity: Curiosity to learn about Threat Hunting with understanding of the MITRE ATT&CK framework, among other security topics.
• Communication: Good written and communication skills to support post-mortem discussions and document complex incidents clearly.

Nice-to-haves

• Relevant certifications (GCIH, GCFA, GNFA, or AWS Certified Security - Specialty).
• Experience with SOAR (Security Orchestration, Automation, and Response) platforms.
• Knowledge of data privacy regulations and security protocols related to data breaches.

Benefits

• Top-notch private health insurance to keep you at your peak.
• Monthly Glovo credit to satisfy your cravings.
• Discounts on transportation, food, and even kindergarten expenses.
• Discounted gym memberships to keep you energized.
• Extra time off, the freedom to work from home two days a week, and the opportunity to work from anywhere for up to three weeks a year.
• Enhanced parental leave, and office-based nursery.
• Online therapy and wellbeing benefits to ensure your mental well-being.

Equal Opportunity Employer

Here at Glovo, we thrive on diversity, we believe it enhances our teams, products, and culture. We know that the best ideas come from a mashup of brilliant diverse minds. This is why we are committed to providing equal opportunities to talent from all backgrounds – all genders, racial/diverse backgrounds, abilities, ages, sexual orientations and all other unique characteristics that make you YOU. We will encourage you to bring your authentic self to work, fostering an inclusive environment where everyone feels heard.