Senior Cybersecurity Researcher

Volvo Group; Göteborgs kommun; On-site; SEK 900,000 - 1,100,000; Full time

Job summary

Volvo Group is seeking a senior security engineer to join the global Cyber Defense Center. You will design and operate a software-defined security platform, applying Everything-as-Code to detect, respond, and adapt across the enterprise.

Join DTO to work in agile, cross-functional teams, shaping the security architecture with modern tooling, AI readiness, and strong collaboration across Volvo Group entities worldwide.

Qualifications

• Strong collaboration and communication bridging engineering and SOC.
• Solid background in SOC and/or SecOps engineering.
• Proficiency in Python or PowerShell, APIs, and data structures.
• Expertise in Splunk SPL, KQL, SQL and security scripting.
• Experience with Git and CI/CD for infra and logic as code.
• Hands-on with enterprise security controls (XDR/EDR/NDR, Firewalls, DLP).
• Deep knowledge of attacker tactics and deception assets.

Responsibilities

• Engineer Detection-as-Code using KQL, SPL, SQL, Python with version control.
• AutomateThreat Response by building modular playbooks.
• Deception Engineering with canaries and honeytokens.
• Tune security controls (XDR, firewall, cloud security, DLP).
• Translate analytical needs into architecture and code.
• Integrate data models, APIs, and threat intel for AI workloads.
• Develop detection across SIEM, data lakes, S3 storage, federated search.
• Close detection gaps and hand over to technical teams.
• Maintain CI/CD pipelines with automated validation gates.

Skills

Collaboration

Core Security

Engineering Mindset

Query languages

GitOps & CI/CD

Security tooling

Active defense

Tools

Python

PowerShell

Docker

Terraform/Bicep

Job description

Union Representatives For Swedish Applicants

Akademikerna – Mikael Johansson, [phone]

Unionen – Lajla Dahlsjö, [phone]

Ledarna – Carina Sachade, [phone]

We value your data privacy and therefore do not accept applications via mail.

“In some countries and for specific positions within Volvo Group Digital & IT, background checks may be required, in accordance with local laws & regulations. If this is applicable to the role you have applied for, you will be informed.”

We value your data privacy and therefore do not accept applications via mail.

Who We Are And What We Believe In

We are committed to shaping the future landscape of efficient, safe, and sustainable transport solutions. Fulfilling our mission creates countless career opportunities for talents across the group’s leading brands and entities.

Applying to this job offers you the opportunity to join Volvo Group. Every day, you will be working with some of the sharpest and most creative brains in our field to be able to leave our society in better shape for the next generation. We are passionate about what we do, and we thrive on teamwork. We are almost 100,000 people united around the world by a culture of care, inclusiveness, and empowerment.

Volvo Group Digital Technology & Operations (DTO) is a new division established to integrate the capabilities of VG Digital & IT and VG Connected Solutions to accelerate the digital transformation in Volvo Group. The organizational set up is structured around domains, digital products with functions for digital excellence to deliver outstanding customer experience.

Joining the new DTO division means being part of a fast-moving digital product-oriented organization where teams truly own what they build from idea to delivery. In DTO, we work in agile, cross-functional teams, mastering the latest technology, and creating outstanding digital experiences that make a real difference for our colleagues and Volvo Group customers around the world. We put people first and build our culture on trust, passion, customer success, change, and performance. If you want to grow, collaborate across functions and entities, and help shape the future of digital products within Volvo Group, DTO is a great place to be.

In some countries and for specific positions within Volvo Group Digital Technology & Operations, background checks (verification of selected information provided by the candidate) may be required, in accordance with local laws & regulations. If this is applicable to the role you have applied for, you will be informed.

Transport is at the core of modern society. Imagine using your expertise to shape sustainable transport and infrastructure solutions for the future. If you seek to make a difference on a global scale, working with next-gen technologies and the sharpest collaborative teams, then we could be a perfect match.

We are seeking a senior security engineer to join our global Cyber Defense Center (CDC) Engineering team. You will apply an Everything-as-Code approach to build and manage our software-defined security operations architecture, designing the logic and systems that power our global detection and response platform.

Key Responsibilities

• Engineer Detection-as-Code: Write detection logic using KQL, SPL, SQL, and Python. Manage the lifecycle strictly through version control and CI/CD pipelines. Create new monitoring use cases based on red team exercises, CTIC reports, and your own hypothesis-driven threat research.
• Automate Threat Response: Build and integrate modular automation playbooks across the security stack to accelerate incident response.
• Deception Engineering: Architect and scale enterprise deception capabilities (canaries, honeytokens) to detect adversary activity across all stages of the attack lifecycle.
• Optimize Security Controls: Configure and tune enterprise security controls (XDR, firewalls, cloud security, DLP) to adapt to new threats.
• Drive Capability Engineering: Partner with cross-functional teams to translate analytical needs into architecture and working code. Ensure engineering output directly supports frontline defenders without adding operational friction.
• Establish AI & Data Foundations: Integrate contextual data models (like knowledge graphs), API gateways, and threat intelligence pipelines to support our targeted AI and ML workloads.
• Leverage Hybrid Data Ecosystems: Develop detection and automation use cases across a variety of different data architectures (SIEM, data lakes, S3/Storage blobs, Federated Search).
• Mitigate Security Gaps: Mitigate detection and response gaps through the creation of new detection rules, improvement of processes, new architectural designs, and hand-over to other technical teams.
• Enforce Pipeline Quality: Build and maintain CI/CD pipelines with automated validation gates for secure content deployment. Use breach attack simulation & threat intelligence verification where applicable in larger validation workflows.

Required Skills & Qualifications

• Collaboration & Articulation: Problem-solving mindset with the ability to bridge the gap between engineering and SOC operations effectively. Able to convey targeted messages to different audiences.
• Core Security Expertise: Strong background in SOC and/or SecOps engineering.
• Engineering Mindset: Proficiency in Python or PowerShell, software engineering best practices, APIs, and data structures (JSON/YAML).
• Query Mastery & Scripting: Deep proficiency in security query languages (Splunk SPL, KQL, SQL) and Python/TypeScript.
• GitOps & CI/CD: Hands-on experience with Git and CI/CD platforms for managing infrastructure and logic as code.
• Security Tooling: Technical experience configuring and administering enterprise security controls (XDR/EDR/NDR, Firewalls, Cloud Security, DLP, Identity).
• Active Defense: Deep expertise in adversary tactics and techniques to position deceptive assets along realistic attack paths without impacting production.

Good-to-Have Skills

• Data Modeling: Familiarity with Graph Databases (Neo4j, Cosmos DB Gremlin) and entity relationship modeling.
• Applied AI: Experience integrating LLMs or building RAG pipelines for enterprise use cases.
• Containerization & IaC: Experience with Docker, API Gateways, and Infrastructure-as-Code (Terraform/Bicep).
• Software Development: Experience working with compiled languages (C# / .NET).
• OT Security: Exposure to Operational Technology (OT) and manufacturing environments.