Cyber SOC Manager (German) – XDR & Cloud Security Lead

EY; Málaga; Hybrid; EUR 70,000 - 100,000; Full time

Benefits offered by this job

Hybrid work model

Career development

Well-being program

Volunteering opportunities

Rewards program

Job summary

EY GDS Spain is seeking a Cyber Security SOC Manager (German Speaker) to drive cloud security monitoring using MS Sentinel/Defender XDR within a hybrid setup in Málaga. You will architect security monitoring, create runbooks, and guide customers through testing, pilot to production stages, ensuring successful deployments.

You will serve as the cloud security SME, shaping best practices across Azure, Sentinel, and Defender offerings, while coordinating data connectors and incident response

Qualifications

• Bachelor-level engineering or tech degree.
• Fluent German (C1) or higher.
• Strong English communication skills.
• Experience in cloud security monitoring and incident response.
• Azure certifications are a plus.

Responsibilities

• Architect and implement cloud security monitoring with MS Sentinel/Defender XDR.
• Develop, test and deploy Sentinel use cases and playbooks.
• Advise customers during testing, pilot, production and training phases.
• Act as SME for cloud security capabilities and Azure platform design.
• Configure incidents, dashboards and data connectors in Sentinel.

Skills

MS Sentinel/Defender

Threat modelling

Mitre ATT&CK

Cloud security

Python scripting

Education

B.Tech./B.E.

Tools

MS Sentinel

Defender for Cloud

Azure

Splunk

QRadar/LogRhythm

Job description

EY GDS Spain is seeking a Cyber Security SOC Manager (German Speaker) to drive cloud security monitoring using MS Sentinel/Defender XDR within a hybrid setup in Málaga. You will architect security monitoring, create runbooks, and guide customers through testing, pilot to production stages, ensuring successful deployments.

You will serve as the cloud security SME, shaping best practices across Azure, Sentinel, and Defender offerings, while coordinating data connectors and incident response