Cyber Defense & Incident Response Specialist

Delivery Hero; España; Hybrid; EUR 55,000 - 75,000; Full time

Benefits offered by this job

Health insurance

Glovo credit

Transportation discounts

Gym membership

Time off: work from home 2 days/week

Work from anywhere up to 3 weeks/year

Parental leave

Nursery at office

Online therapy and wellbeing

Job summary

Glovo is seeking a CSIRT Engineer to join our Cyber Defense team. You will be the shield of Glovo, defending our ecosystem with proactive threat hunting, high-level automation, and sophisticated detection engineering.

Responsibilities include incident response, building playbooks, tuning alerts, and improving SIEM/SOAR tooling, while collaborating to maintain full visibility across Glovo.

Qualifications

• Experience in Incident Response and Digital Forensics is a plus.
• Desirable operational experience with AWS and cloud-native logs.
• Proficiency in Python (or Golang) to automate responses and build tooling.
• Knowledge of threat monitoring and fine-tuning alerts (detection engineering).
• Curiosity to learn Threat Hunting and MITRE ATT&CK framework; strong communication skills.

Responsibilities

• Be the First Responder: support DFIR efforts and investigations.
• Architect Readiness: design and maintain playbooks and methodologies.
• Precision Monitoring: create and tune alerts with high fidelity, low noise.
• Automate & Orchestrate: build tooling for incident response to reduce manual toil.
• Hunt the Threat: research threats and perform threat-hunting across infrastructure.
• Manage the Pipeline: coordinate log ingestion tools and SIEM visibility.

Skills

Incident Response

Digital Forensics

AWS

Python

Golang

Threat Hunting

MITRE ATT&CK

Communication

Tools

SIEM

SOAR

Job description

Glovo is seeking a CSIRT Engineer to join our Cyber Defense team. You will be the shield of Glovo, defending our ecosystem with proactive threat hunting, high-level automation, and sophisticated detection engineering.

Responsibilities include incident response, building playbooks, tuning alerts, and improving SIEM/SOAR tooling, while collaborating to maintain full visibility across Glovo.