Senior Threat Detection & Response Engineer (Hybrid, Cloud)

Ryanair - Europe's Favourite Airline; Madrid; Hybrid; EUR 70.000 - 110.000; Vollzeit

Benefits dieser Stelle

Hybrid work model

Travel discounts

Health insurance discounts

Zusammenfassung

Ryanair Labs in Madrid is recruiting two Information Security Senior Threat Detection & Response Engineers to join Europe’s Largest Airline Group. You will proactively identify blind spots in telemetry, detections and controls across on-prem, AWS, GCP and Azure, and close gaps with evidence-backed fixes, while participating in incident response.

In this hands-on role you will map telemetry to MITRE ATT&CK, build detections as code, run purple-team exercises and automate triage with

Qualifikationen

• 6+ years in detection engineering, SOC or IR.
• Hands-on SIEM, EDR and cloud security across multiple platforms.
• Experience converting rules with Sigma and testing in CI.
• Proven track record closing detection gaps with measurable outcomes.
• Adversary emulation and MITRE ATT&CK-based coverage assessments.

Aufgaben

• Own detection and visibility across AWS, GCP and Azure control planes.
• Lead purple-team exercises and translate findings into detections.
• Hunt for uncovered techniques and drive remediation.
• Automate enrichment, triage and response with code and playbooks.
• Produce metrics on ATT&CK coverage, gap closure and MTTR.

Kenntnisse

6+ years experience

SIEM skills

EDR experience

MITRE ATT&CK usage

Multicloud security

Adversary emulation

Python/PowerShell

LLM-assisted tooling

Incident response

Communication under pressure

Tools

Microsoft Sentinel

Splunk

Elastic/OpenSearch

SPL/KQL/ESQL

Sigma

Git/CI

Cloud providers: AWS, GCP, Azure

Jobbeschreibung

Ryanair Labs in Madrid is recruiting two Information Security Senior Threat Detection & Response Engineers to join Europe’s Largest Airline Group. You will proactively identify blind spots in telemetry, detections and controls across on-prem, AWS, GCP and Azure, and close gaps with evidence-backed fixes, while participating in incident response.

In this hands-on role you will map telemetry to MITRE ATT&CK, build detections as code, run purple-team exercises and automate triage with