Senior SOC Engineer: Incident Response & Automation

HelloFresh; Berlin (NH); On-site; USD 103,000 - 148,000; Full time

Benefits offered by this job

Pension scheme (HelloFresh)

Hybrid working model

HelloFresh box discounts

German language learning budget

HelloFresh Academy

Mental health support

Transportation perks

Headspace access

Spill wellbeing platform

Sabbatical leave options

Job summary

HelloFresh in Berlin is seeking an experienced SOC Analyst to join our security operations, mentor junior analysts, and lead incident response while maturing logging, monitoring, and automation across AWS and enterprise IT. You will collaborate with the Manila team, handle escalations, and refine SOC processes for faster containment and reporting.

Ideal candidates bring cloud security monitoring experience, strong scripting skills in Python/Go, and the ability to craft detection rules with AI

Qualifications

• Proven security monitoring and incident response experience in public cloud environments.
• Experience with cloud SIEM & SOAR platforms, DDoS mitigation and preventing tools and Layer-7 Web-based perimeter security controls.
• Excellent programming (automation) skill with Python / Go.
• AI-enhanced coding to write and debug Python scripts for security automation.
• Ability to write detection rules (Sigma, KQL) with AI tooling.
• Understanding of network intrusion methods and IDS/IPS concepts.
• Strong log analysis across multiple sources and noise reduction techniques.
• Good communication and reporting skills.
• Willingness to on-call in rotational shifts.

Responsibilities

• Mature logging and monitoring of Cloud, IT and App workloads using automation and IaC.
• Ingest and optimize security events from App logs, Kubernetes, CloudTrail, CloudFlare, ELB logs.
• Conduct threat hunts against file-less malware and APTs using Sysmon, Osquery, RITA, Zeek.
• Use AI tools to write scripts for security automation and data parsing.
• Summarize high-volume logs and explain complex code snippets with LLMs.
• Develop advanced cross-correlation rules beyond out-of-the-box to detect attacks.
• Generate security metrics and reporting on incidents and SOC effectiveness.
• Lead incident detection and response in AWS cloud and enterprise IT environments.
• Act as shift lead and communicate with Berlin SOC leadership during active incidents.
• Suggest detection rule tuning and SOP refinements; contribute to knowledge base.

Skills

Security monitoring

Incident response

Cloud environments

Python

Go

AI-assisted coding

Detection rules (Sigma/KQL)

Log analysis

Communication skills

On-call readiness

Tools

Sysmon

Osquery

RITA

Zeek

ElasticSearch

Splunk

Sumo Logic

Graylog

KQL

Sigma

Job description

HelloFresh in Berlin is seeking an experienced SOC Analyst to join our security operations, mentor junior analysts, and lead incident response while maturing logging, monitoring, and automation across AWS and enterprise IT. You will collaborate with the Manila team, handle escalations, and refine SOC processes for faster containment and reporting.

Ideal candidates bring cloud security monitoring experience, strong scripting skills in Python/Go, and the ability to craft detection rules with AI