Azure Security Monitoring Engineer & Automation Developer

Bayer; Warszawa; Hybrid; PLN 155,990 - 186,845; Full time

Benefits offered by this job

Home office allowance

Hybrid work model

Flexible benefits for leisure and well

Life, accident, and disability ins.

Employer supported pension plans

Extra Paid Holidays

Job summary

Bayer in Warsaw is seeking a highly skilled Security Monitoring Platform Developer (Azure Developer) to design, implement and maintain Azure-native security automation applications in the CSM Cyber Security Monitoring squad. You will build CheckMail automation pipelines, MISP2Sentinel connectors, and data pipelines across Azure SQL, ADX and Sentinel to enable threat detection and incident response.

The role requires strong Python development, Azure PaaS experience, and collaboration across

Qualifications

• Strong hands-on development experience in Python, including Azure Functions, async processing, and API integrations.
• Experience with Azure PaaS services: Function Apps, Logic Apps, Service Bus, Key Vault, Event Hub, Application Insights
• Solid understanding of REST APIs, JSON, and data serialization formats (STIX, MISP)
• Experience with SQL databases and data pipeline patterns (Azure SQL, ADX/KQL)
• Understanding of Git-based workflows, IaaC (Terraform), and CI/CD (GitHub Actions)
• Experience in IT Security, SIEM, or related field- understanding of security incident lifecycle
• Understanding of IT and enterprise systems including business processes and data flows
• Collaboration skills and ability to work in global teams across time zones
• Excellent oral and written communication skills (English required, German a plus)

Responsibilities

• Develop and maintain the Checkmail automation pipeline- an Azure-native application for automated analysis, enrichment, LLM-based classification, and escalation of user-reported phishing emails, including Function Apps (Python), Logic Apps, Service Bus integration, ADX data persistence, and Sentinel incident creation
• Implement and operate the MISP2Sentinel threat intelligence connector- Azure Function App (Python) using PyMISP and MISP-STIX libraries to periodically push IoCs from DCSO-hosted MISP to the Sentinel Threat IntelligenceIndicator table via Upload Indicators API
• Develop Azure Function Apps (Python) for SQL-based data replication- building and maintaining data pipelines between Azure SQL Database, ADX, and Sentinel to provide context data for detection and enrichment workflows
• Design and implement complex security incident handling logic in Microsoft Sentinel- including multi-step enrichment workflows (VirusTotal, URLScan, CrowdStrike Sandbox), Analytics Rules, Automation Rules, and Logic App-based orchestration for SOC triage and ServiceNow ticketing
• Integrate external security APIs and services into the SIEM platform- including enrichment providers, sandbox integrations, and threat intelligence feeds, with proper error handling, retry logic, and Dead Letter Queue management
• Follow and contribute to the established IaaC deployment process- all application code and infrastructure deployed via GitHub Actions, Terraform, and the CSM GitHub repositories
• Ensure application reliability and observability- implement structured logging, health monitoring integration, Application Insights instrumentation, and proactive alerting for all developed components
• Support content handover and knowledge transfer- ensure all developed components are documented, follow CSM naming conventions, and are integrated into the established RBAC and deployment model
• Collaborate with CSM analysts to translate detection and automation requirements into scalable, maintainable application code.

Skills

Python development

English communication

Collaboration across time zones

Cyber security knowledge

REST APIs

Education

University degree in CS/IT/Cyber Security

Tools

Azure Functions

Logic Apps

Service Bus

Key Vault

Event Hub

Application Insights

SQL databases

ADX

GitHub Actions

Terraform

Job description

Bayer in Warsaw is seeking a highly skilled Security Monitoring Platform Developer (Azure Developer) to design, implement and maintain Azure-native security automation applications in the CSM Cyber Security Monitoring squad. You will build CheckMail automation pipelines, MISP2Sentinel connectors, and data pipelines across Azure SQL, ADX and Sentinel to enable threat detection and incident response.

The role requires strong Python development, Azure PaaS experience, and collaboration across