Senior Incident Response Engineer (Global SOC)

F. Hoffmann-La Roche Ltd; Madrid; On-site; EUR 90,000 - 120,000; Full time

Job summary

Roche in Madrid is seeking a Senior Cybersecurity Engineer (Incident Response Operations) to join the Global Security Monitoring and Incident Response (MIR) team. You will monitor and respond to incidents across on‑premise and cloud environments, triage threats, and lead containment and remediation efforts during active security events.

The role requires 7+ years in information security with SOC/CSIRT experience, strong scripting skills (Python/JavaScript/Go/Rust), and the ability to communicate

Qualifications

• Bachelor's degree in a technical field and 7+ years of information security experience.
• Experience communicating security concepts to non-technical audiences.
• Strong triage, analysis, and incident escalations in SOC/CSIRT environments.

Responsibilities

• Monitoring and Incident Response for a global environment
• Take decisions, often under pressure, given partial information
• Contribute to proactive threat detection efforts
• Lead containment and remediation efforts during active security incidents
• Perform forensic analysis of relevant artifacts to support investigations
• Contribute to detection engineering activities across a global team
• Brief team members and leadership on relevant threats to Roche group
• Communicate information security concepts and situations to senior management
• Contribute operational feedback to strengthen detection and response processes
• Mentor newer team members

Skills

Incident response

SOC/CSIRT

Threat hunting

Scripting (Python/JS/Go/Rust)

OS knowledge (Windows/Linux/macOS)

Communication skills

English fluency

Education

Bachelor's degree in a technical field

Job description

Roche in Madrid is seeking a Senior Cybersecurity Engineer (Incident Response Operations) to join the Global Security Monitoring and Incident Response (MIR) team. You will monitor and respond to incidents across on‑premise and cloud environments, triage threats, and lead containment and remediation efforts during active security events.

The role requires 7+ years in information security with SOC/CSIRT experience, strong scripting skills (Python/JavaScript/Go/Rust), and the ability to communicate