Threat Hunter & Incident Response Engineer

Glovo Group; Barcelona; Hybrid; EUR 70,000 - 90,000; Full time

Benefits offered by this job

Private health insurance

Glovo credit for meals

Discounts on transport and other perks

Gym discounts

Flexi‑work: 2 days work from home

Job summary

Glovo in Barcelona is seeking a CSIRT Engineer to join our Cyber Defense team. You will be the shield of Glovo, defending our ecosystem and proactively hunting threats while building automation for incident response.

Responsibilities include DFIR investigations, designing playbooks, tuning high‑fidelity alerts, and coordinating with SIEM/log ingestion. Desired skills: Python or Go, AWS cloud experience, and threat hunting mindset.

Qualifications

• Experience in Incident Response and Digital Forensics is a plus.
• Operational experience with AWS and cloud-native logs is desirable.
• Programming experience to automate responses (Python or Golang).
• Knowledge of threat monitoring and alert tuning.
• Curiosity for Threat Hunting and MITRE ATT&CK framework.

Responsibilities

• Be the First Responder: DFIR investigations after security incidents.
• Architect readiness: design playbooks and methodologies for incidents.
• Precision Monitoring: tune alerts for high fidelity and low noise.
• Automate & Orchestrate: build tooling to support incident response.
• Hunt the Threat: research threats and run threat-hunting exercises.
• Manage the Pipeline: coordinate SIEM and log ingestion visibility.

Skills

Incident Response

Digital Forensics

AWS Cloud

Python

Go / Golang

Threat Hunting

MITRE ATT&CK

Communication

Tools

SIEM

SOAR

Job description

Glovo in Barcelona is seeking a CSIRT Engineer to join our Cyber Defense team. You will be the shield of Glovo, defending our ecosystem and proactively hunting threats while building automation for incident response.

Responsibilities include DFIR investigations, designing playbooks, tuning high‑fidelity alerts, and coordinating with SIEM/log ingestion. Desired skills: Python or Go, AWS cloud experience, and threat hunting mindset.