Security Engineer - Detection & Response

Returnless / SendDirect B.V.; États-Unis; À distance; USD 123 000 - 179 000; Plein temps

Avantages offerts par ce poste

Meal allowance up to €115 net per mês

Ergonomic home office setup

Team events and company gatherings

EGYM

Wellpass and JobRad subsidy

Vermögenswirksame Leistungen

Company pension

Résumé du poste

Returnless / SendDirect B.V. ищет старшего специалиста по кибербезопасности, который возглавит развитие SIEM и контента детекции. Вы будете руководить расследованиями инцидентов, развивать детекцию, управлять базами и настраивать защиту на консолях и в облаке.

Опыт в Azure обязателен, владение английским на высоком уровне. Роль удаленная с приоритетом в Германии; требования включают автономность, способность устанавливать стандарты и взаимодействовать с внешними партнерами.

Qualifications

• Вы создали или существенно переработали детекционную систему, а не только эксплуатировали чужую.
• Вы писали и настраивали детекционный контент в продакшн SIEM и владеете языком запросов.
• Лично расследовали реальные инциденты от начала до конца.
• Вы спроектировали и внедрили базовый уровень защиты.
• Вы скриптуете на автоматизацию: PowerShell, Python или аналог.
• Вы устанавливаете технический стандарт, за которым следуют другие.
• Свободно владеете английским языком.

Responsabilités

• Владение и развитие SIEM и контента детекции.
• Руководство техническими расследованиями инцидентов.
• Хантинг угроз на основе телеметрии.
• Настройка базовых защит на конечных точках, серверах и в облаке.
• Управление отношениями с внешними партнерами по безопасности.
• Преобразование результатов тестирования в детекции.

Connaissances

Detection engineering

Incident response

Threat hunting

PowerShell

Python

Fluent English

Outils

SIEM

Azure

Description du poste

Задачи:

• JTL-Software builds the e-commerce software our customers run their businesses on.


• As the platform and the business grow, we are expanding our security team.


• This is a newly created Staff-level position with end-to-end ownership of that area.


• You will own our SIEM and the detection content that runs on it, lead security investigations from first alert to resolution, and set the hardening standard across endpoints, identity, servers and cloud.


• You will also own the engineering relationship with the external partners who support us.


• We are looking for someone who has built a detection capability.


• Our environment is predominantly Microsoft and Azure, and you will have genuine influence over the tooling, the architecture and the standards we adopt instead of maintaining decisions that were made before you arrived.


• This is a senior individual contributor role.


• You set the detection and hardening standard for the security team, you work without a technical lead above you, and you report directly to the Director Cybersecurity & IT.


• Build and own the SIEM


• Take ownership of the platform from the implementation partner, to a depth that allows you to defend or revise its design decisions.


• Own data source onboarding, parsing, normalisation and coverage.


• Make and justify explicit decisions on log coverage, retention and ingest cost.


• Develop the platform as the estate grows, rather than leaving it as delivered.


• Detection engineering Write, tune and maintain the detection content, beyond the vendor's default rule set.


• Map coverage against the techniques relevant to our estate and close the gaps that matter.


• Treat detections as code: version control, review, testing, and a defined process for false positives.


• Convert offensive security findings into detections.


• Incident response Investigate and lead the technical side of security incidents end to end.


• Threat hunting against our own telemetry, proactively rather than in response to a report.


• Own the technical half of the incident response process and refine it after each event.


• Hardening Design and roll out security baselines across endpoints, servers, identity and cloud.


• Work with IT and engineering to get them applied, including where that requires making the case.


• Measure configuration drift and close it.


• Partners and tooling Own the engineering relationship with our external security partners: scope, escalation and expectations.


• Make build-versus-buy decisions on detection and response tooling, including the cost implications.

Требования:

• You have built or substantially rebuilt a detection capability, rather than only operating one designed by someone else.


• You have written and tuned detection content in a production SIEM yourself, and are fluent in its query language.


• You have personally investigated real security incidents from start to finish.


• You have designed and rolled out a hardening baseline.


• You script to a level where automation is your default: PowerShell, Python or equivalent.


• You have set a technical standard that others followed, without formal authority over them.


• Fluent English, written and spoken.

Условия:

• Remote-first within Germany, with the option to work remotely from eligible countries for up to 180 days per year


• Meal allowance of up to €115 net per month


• Ergonomic workspace allowance for your home office setup


• Regular team events, company-wide gatherings, and summer and Christmas parties to stay connected as a remote-first company


• EGYM


• Wellpass and JobRad subsidy


• Financial benefits including capital-forming payments (Vermögenswirksame Leistungen) and a company pension scheme