Cyber Security Engineer

Unisys; España; Hybrid; EUR 69,000 - 90,000; Full time

Job summary

Unisys is seeking a Cybersecurity Engineer to join a Threat Detection Engineering team for a freelance role. The position involves designing, implementing, and maintaining detection content across SIEM and runtime platforms, with a focus on Linux and containerized workloads within a remote EU framework.

The role requires advanced knowledge of Linux security, Kubernetes telemetry, and hands-on experience with container security tools such as Falco or Sysdig.

Qualifications

• Level 5 EU Qualifications Framework corresponds to two years of post-secondary education.
• Strong knowledge of Linux operating systems and Linux security.
• Ability to design, test, validate, deploy, and maintain runtime detection rules.
• Eligibility for a European Security Clearance at EU-LEVEL SECRET.

Responsibilities

• Develop threat-informed detection content by translating cyber threat intelligence and incident reports into detection objectives.
• Design, implement and maintain managed detection rules using the internal framework.
• Deploy detection rules across SOC platforms, including SIEM and endpoint/run-time detections.
• Develop detection use cases for Linux workloads and containers.
• Address threats related to execution, persistence, privilege escalation, credential access, and data exfiltration in containers/Kubernetes.

Skills

Linux security

Kubernetes security

Container security

Threat hunting

Detection engineering

Education

Level 5 EU Qualifications Framework

Tools

Falco

Sysdig

Job description

Our client is a prestigious European institution with a Cyber Security Operations Centre whose mission is to strengthen the IT Security for the whole organization.

The Institution is looking for a skilled Cybersecurity Engineer to reinforce their Threat Detection Engineering team. We are looking for a Cybersecurity Engineer professional who will be involved in the design, implementation, integration, configuration, administration, and maintenance of the client’s cybersecurity infrastructure and solutions.

If you are looking for a big-impact cybersecurity opportunity, then we have the right one for you!

Contract type: Freelancer agreement, with an initial contract duration of 220 days, with the possibility for renewal

Workplace type: Remote within EU territory (besides 20 days of on-site office presence in Luxembourg at the client's site; trips are not compensated)

Daily rate offer for this role: 430 euros

Key Responsibilities:

The Threat Detection Engineer will:

• Develop threat-informed detection content by translating cyber threat intelligence, incident reports and adversary techniques into documented threat vectors, detection hypotheses and measurable detection objectives.
• Design, implement and maintain managed detection rules using the internal Detection Engineering framework.
• Deploy detection rules across Security Operations Centre platforms, including SIEM and endpoint or runtime detection solutions.
• Develop detection use cases for physical, virtual and containerised Linux workloads.
• Address threats related to execution, persistence, privilege escalation, credential access, defence evasion, lateral movement and data exfiltration in container and Kubernetes environments.
• Integrate and validate container-security telemetry sources, including runtime events, Kubernetes audit logs, orchestration events and relevant cloud control-plane logs.
• Ensure that security data is properly normalised, enriched, ready for correlation and of sufficient quality for use within the corporate SIEM.
• Continuously tune and optimise deployed detections, including false-positive reduction, exception and exclusion management, suppression logic, risk scoring and performance monitoring.
• Conduct proactive threat-hunting and retro-hunting activities across containerised Linux workloads.
• Document threat-hunting results and convert validated detection prototypes into production-ready managed detection rules.
• Map detections to relevant threat techniques, identify detection coverage gaps and recommend improvements to logging and telemetry.

Candidates must hold a qualification corresponding to at least Level 5 of the European Qualifications Framework, which typically corresponds to two years of post-secondary education or higher for the Confirmed seniority level.

Required Knowledge and Experience

• In-depth knowledge of Linux operating systems and Linux security.
• Strong understanding of attacker techniques affecting Linux environments.
• Knowledge of process, file-system and network telemetry, audit sources, persistence techniques and privilege-escalation methods.
• Understanding of container runtime concepts, including namespaces, cgroups, image lifecycle and isolation boundaries.
• Knowledge of common container attack paths, including container escape and breakout scenarios.
• Hands-on knowledge of Kubernetes security telemetry and threats.
• Experience with Kubernetes audit logging, RBAC abuse patterns, workload identities, admission controls and common security misconfigurations.
• Practical experience with at least one container runtime detection solution, such as Falco, Sysdig or an equivalent platform.
• Experience authoring and tuning runtime detection rules.
• Experience managing detection suppressions, exclusions and rule lifecycles in production environments.
• Demonstrated ability to design, test, validate, deploy and maintain detection logic through a structured detection lifecycle.
• Eligibility for a European Security Clearence at EU-LEVEL SECRET