Cyber Threat Detection Analyst / Engineer (f/m)

Bosch; Warsaw (IN); Hybrid; USD 120,000 - 180,000; Full time

Benefits offered by this job

Hybrid work with flexible hours

Annual bonus

Referral bonus program

Private medical care

Job summary

Bosch in the United States seeks a Detection Engineering professional to analyze CTI, emulate adversaries, and develop high-fidelity detection rules. You will work with SOC and IR teams to strengthen security posture.

This role requires MITRE ATT&CK expertise, scripting with Python/PowerShell/Bash, and experience with KQL/SQL/Splunk SPL. A strong advantage for offensive security certs and CTI/SOC background; English fluency is essential. Hybrid work and competitive benefits.

Qualifications

• Multiple years of experience in detection engineering, threat hunting, or offensive security.
• Deep expertise in the MITRE ATT&CK framework and mapping TTPs.
• Proficient in scripting/automation languages (Python, PowerShell, Bash) and query languages (KQL, SQL, Splunk SPL).
• Offensive security certifications (e.g., OSCP, OSEP, CRTO, GXPN, GPEN, GCIH or GIAC) are a strong plus.
• Familiarity with CTI and/or SOC Analyst experience (e.g., Microsoft SC-200) is a strong asset
• Analytical, structured, and investigative mindset; fluent English is a must (German or other European languages are a plus).

Responsibilities

• Analyze CTI, attack surfaces, and detection gaps to prioritize visibility.
• Conduct adversary emulation and simulations to validate coverage.
• Develop, test, and tune high-fidelity detection rules and preventive controls.
• Collaborate with SOC and incident response to streamline alerts and reduce false positives.

Skills

MITRE ATT&CK

Adversary emulation

Analytical thinking

English fluency

SOC collaboration

Tools

Python

PowerShell

Bash

KQL

SQL

Splunk SPL

Job description

Company Description

At Bosch, we shape the future by inventing high-quality technologies and services that spark enthusiasm and enrich people’s lives. Our promise to our associates is rock-solid: we enjoy our work, we inspire each other, we provide equal growth opportunities for all team members, all roles are represented in all countries. We grow together!

Job Description

• Visibility & Detection Gap Analysis: Conduct analyses of Cyber Threat Intelligence (CTI), attack surfaces, and the current detection landscape to identify and prioritize visibility and detection gaps.

• Adversary Emulation: Perform adversary emulation and simulations to validate and continuously improve detection coverage.

• Rule Development & Tuning: Develop, test, and tune high-fidelity detection rules and preventive controls to strengthen the overall security posture.

• SOC Collaboration: Collaborate with SOC and incident response teams to streamline alert triage, optimize playbooks, and reduce false positives.

Qualifications

• Professional Experience: Multiple years of experience in detection engineering/content development, threat hunting, or offensive security.

• Technical Expertise: Deep expertise in the MITRE ATT&CK framework, from converting hypotheses into MITRE-mapped adversary TTPs to evaluating potential visibility and coverage gaps.

• Programming & Automation: Proficient in scripting and automation languages (e.g., Python, PowerShell, Bash) and proven experience in most commonly used query languages (e.g., KQL, SQL, Splunk SPL).

• Certifications (Strong Plus): Offensive security certifications (e.g., OSCP, OSEP, CRTO, GXPN, GPEN, GCIH or other relevant GIAC/offensive certifications).

• Threat Intelligence & SOC: Familiarity with or formal training in Cyber Threat Intelligence (CTI) and/or SOC Analyst experience (e.g., Microsoft SC-200) is a strong asset

• Soft Skills & Language: Analytical, structured, and investigative mindset; fluent English is a must (German or other European languages are a plus).

Additional Information

Bosch’s culture of innovation and digital transformation offers you a fantastic platform to grow your skills and enhance your network. We are dedicated to building a warm, open, transparent, and inclusive work environment for all.

Work LikeABosch:

• Employment Contract
• Competitive salary + annual bonus
• Hybrid work with flexible working hours
• Referral Bonus Program
• Copyright costs for IT employees

Grow LikeABosch:

• Complex environment of working, professional support and possibility to share knowledge and best practices
• Ongoing development opportunities in a multinational environment
• Broad access to professional trainings (incl. language courses), conferences and webinars

Live LikeABosch:

• Private medical care and life insurance
• Cafeteria System with multiple benefits (incl. MultiSport, shopping vouchers, cinema tickets, etc.)
• Prepaid Lunch Card
• Number of benefits for families (for instance summer camps for kids)
• Non-working day on the 31st of December