Security Operations Engineer

DSwiss AG; Lisboa; On-site; EUR 60,000 - 90,000; Full time

Benefits offered by this job

25 Days of Vacation

Empowered to Make an Impact

Learn from the Best

Meal allowance

Health insurance coverage

Public transportation allowance

Sustainability commitment

Job summary

DSwiss AG seeks a Security Operations Engineer to run day-to-day security operations and act as Deputy to the CISO. You will manage Defender, Entra ID, vulnerability management, ELK/SIEM, and incident response while enabling secure AI usage across the organization.

You will collaborate with IT and Infrastructure to implement security controls and ensure audit readiness. The role emphasizes automation, proactive security improvements, and governance to support decision-making in a regulated

Qualifications

• Hands-on security operations experience.
• Experience with Defender, Entra ID and SIEM.
• Experience in vulnerability management and incident response.
• Familiarity with ISO 27001 controls and audits.

Responsibilities

• Lead endpoint security operations and policy tuning.
• Own identity and access policy and admin roles.
• Manage vulnerability scanning and remediation workflow.
• Oversee ELK/SIEM architecture, queries and dashboards.
• Lead security incident response and runbooks.
• Enable secure use of AI across the company.
• Maintain audit-ready security evidence.
• Identify automation opportunities to reduce manual effort.
• Act as Deputy to the CISO during absences.

Skills

Defender operations

Entra ID admin

Nessus scanning

ELK/SIEM

Incident response

AI security

Automation

ISO 27001

Tools

Nessus

Scanmeter

ELK

Kibana

Intune

JAMF

GitLab

Job description

Through SecureSafe, DSwiss operates a trusted Swiss infrastructure for the secure exchange, delivery and storage of confidential information. Banks, insurance companies, public institutions and other regulated organisations use our solutions when data protection, data sovereignty and security are business-critical. The platform is hosted in Switzerland, is ISO 27001-certified and is based on a zero-knowledge architecture. For 17 years, hundreds of companies and institutions have placed their trust in DSwiss.

We are hiring a Security Operations Engineer to run the day-to-day security operations of DSwiss and to act as Deputy to the CISO. This is a hands-on security role: you will operate and tune Microsoft Defender, own identity and access policy in Entra ID, run the vulnerability management process, build out our ELK/SIEM detection capability, lead security incident response and enable the secure use of AI across the company.

You will work closely with the CISO and with the IT and Infrastructure team in Operations. IT and Infrastructure operate the M365 tenant, the device fleet and the on-premises platform; this role defines the security controls those teams operate within, holds the privileged security roles, and verifies that the controls are effective. Keeping that boundary clean is part of the job.

A core expectation is continuous improvement of security operations: reducing manual triage through automation, raising detection quality, keeping audit evidence current, and reporting security posture in a way that supports decisions. During planned CISO absences you maintain operational continuity, coordinate incident response and elevate appropriately.

What you will do

1. Endpoint security operations (Microsoft Defender)

• Own Defender end-to-end: agent deployment and policy, alert monitoring, investigations, policy tuning, noise reduction and detection quality.
• Define the endpoint hardening baselines and compliance gate criteria that IT applies through Intune and JAMF, and verify they are applied.
• Deploy and maintain security tooling on the fleet using the security roles held in Intune and JAMF.

2. Identity and access policy (Entra ID)

• Own Conditional Access, MFA design, privileged access and PIM, administrative separation and periodic access reviews.
• Define and maintain the admin role model across Entra, Intune, JAMF, GitLab and SaaS tools; review privileged role assignments.
• Set the access revocation requirements for offboarding and check the evidence IT produces.

3. Vulnerability management (Nessus, Scanmeter)

• Run and improve internal and external scanning coverage, schedules and reporting across endpoints and infrastructure using Nessus and Scanmeter.
• Own the Nessus deployment itself: scanner placement, credentialed scanning, scan policies and plugin tuning, asset grouping and reporting templates.
• Prioritise findings by risk and business impact, assign owners and deadlines, and track closure with IT and Infrastructure.
• Maintain a durable reporting cadence and measurable remediation performance.

4. SIEM, logging and detection (ELK/SIEM)

• Own the ELK stack as a security platform: architecture (Elasticsearch cluster, Elastic Agent/Beats, Logstash and ingest pipelines, index lifecycle), ingestion health, source coverage and retention.
• Write and maintain queries in Kibana Dev Tools (Query DSL, KQL, ES|QL) for investigations, detection rules, dashboards and correlation across endpoint, identity and infrastructure telemetry; operationalise detection use cases with playbooks.
• Produce concise security posture reporting for the CISO and stakeholders: trends, improvements, key risks.

5. Security incident response

• Lead security incident handling: triage, containment coordination, evidence collection, remediation follow-up and lessons learned.
• Maintain incident response runbooks and coordinate IT and Infrastructure during security incidents.
• Support investigations that require evidence handling to an audit or legal standard.

6. Secure enablement of AI

• Enable and support secure use of AI tools and workflows across the company, with the CISO and key stakeholders.
• Define and implement practical guardrails: approved tools, data handling rules, access controls, logging and monitoring, user guidance.
• Review new AI use cases pragmatically and support employees with documentation and onboarding guidance.

7. Audit readiness and security evidence

• Maintain security runbooks, operational procedures and control evidence for ISO 27001 and data protection audits.
• Keep access management, incident and vulnerability records in a state that can be evidenced at any time.

8. Automation and optimisation (mandate across the role)

• Identify and implement automation in alert triage, access reviews, vulnerability reporting and evidence collection.
• Reduce manual effort and response times; rationalise security tooling and configurations and keep cost awareness.

9. Security vendors and deputy CISO

• Manage security tooling vendors: renewals, escalation paths, performance and roadmap alignment.
• Act as Deputy to the CISO during absences: maintain day-to-day security operations, coordinate incident response, take operational decisions and elevate appropriately.

How we evaluate success in the first 3 to 6 months

• Defender operations: Consistent triage workflow; reduced alert noise; fewer repeated endpoint findings; timely, well-documented investigations
• Identity and access: Conditional Access and MFA coverage documented and enforced; privileged roles under PIM; first access review cycle completed with evidence
• Endpoint compliance: Hardening baselines and compliance criteria published to IT; compliance gaps visible and trending down
• Vulnerability management: Consistent Nessus and Scanmeter coverage; risk-driven prioritisation; owners and deadlines on every finding; closure cadence reported monthly
• SIEM and detection: Cluster and ingestion architecture documented and stable; agreed source coverage; detection rules and dashboards built from own queries; first use cases live with playbooks
• Incident response: Runbooks current; at least one tabletop or real incident handled end-to-end with lessons learned recorded
• AI enablement: Approved tool list and data handling guidance published; review process for new use cases in operation
• Audit readiness: Security evidence for ISO 27001 controls retrievable without preparation
• Deputy coverage: Demonstrably stable security operations during CISO absence, with appropriate escalation and decision-making

What we are looking for

• Practical experience operating Microsoft Defender: alert triage, investigations, policy tuning, detection improvement.
• Hands-on experience with Entra ID security configuration: Conditional Access, MFA, privileged access and PIM, access reviews.
• Working knowledge of endpoint security controls on macOS and Windows and of how Intune and JAMF enforce them; you do not need to run the fleet, you need to know what to require of it.
• Deep hands-on Nessus experience, essential for this role: scanner architecture, credentialed scanning, scan policy and plugin tuning, false positive handling, risk-based prioritisation and remediation tracking. Scanmeter or equivalent external scanning is a plus.
• Strong ELK experience, essential for this role: Elasticsearch architecture (cluster design, index management and lifecycle, ingest pipelines, Elastic Agent/Beats/Logstash), and fluency writing queries in Kibana Dev Tools (Query DSL, KQL, ES|QL) for investigations, detection rules and dashboards.
• Experience handling security incidents end-to-end, including evidence collection and documentation.
• Solid network fundamentals relevant to security: DNS, DHCP, VPN, segmentation, traffic analysis.
• Demonstrable continuous-improvement mindset: automate, standardise, measure outcomes, reduce manual effort and response times.
• Hands-on exposure to AI tools and workflows, with the ability to support secure, practical adoption in a business environment.

Certifications, required or obtained within the first 6 to 12 months

• CompTIA Security+ or equivalent baseline security certification.
• Microsoft SC-200 (Security Operations Analyst) or equivalent demonstrated competence.

Nice to have, certifications

• Microsoft SC-300 (Identity and Access Administrator), SC-100 (Cybersecurity Architect).
• CompTIA CySA+ or Network+, or a GIAC certification (GCIH, GCIA or similar).
• ISO/IEC 27001 Lead Implementer or Lead Auditor.
• SIEM or security analytics vendor training.
• Elastic Certified Analyst or Elastic Certified Engineer.
• Tenable Nessus or Tenable Vulnerability Management certification.

Nice to have, skills and experience

• Scripting and automation (PowerShell, Bash, Python, KQL) applied to security operations.
• Experience in regulated or ISO 27001-certified environments: audit readiness, investigations, evidence handling.
• Working knowledge of privacy frameworks such as GDPR and the Swiss FADP, and of how security controls support data protection obligations (records of processing, data subject requests, breach notification timelines).
• Experience translating security requirements into pragmatic employee guidance: policies, playbooks, enablement.
• Familiarity with GitLab and SaaS access governance.

We look for people who demonstrate Care, Curiosity, Ownership, Empowerment and Transparency in daily execution: clear communication, dependable follow-through, continuous improvement and respectful collaboration. In this role that also means stating security requirements early and plainly to the teams that operate within them, and treating IT and Infrastructure as partners rather than as an audit subject.

SecureSafe takes its values seriously in practice, not just on a slide deck. Transparency, ownership, empowerment, curiosity, and care shape how the team works and how decisions get made. You'll have:

• 25 Days of Vacation: Recharge and thrive with above-market holiday time, reflecting our people-first approach to work-life balance.
• Empowered to Make an Impact: Every voice matters—you're encouraged to drive improvements, contribute ideas, and create real value from day one.
• Learn from the Best: Grow your skills in a high-performing, international team of experienced and talented professionals.
• Meal allowance, health insurance coverage, and public transportation allowance.
• Work for a company committed to sustainability—our data centers operate climate-neutral