Cyber Security Engineer

Responsibilities:

Design and implement automated security workflows that connect tools across detection, response, and remediation pipelines.
Build integrations between SIEM/SOAR platforms, case management systems (e.g., ServiceNow, Jira, etc.), and internal APIs to enable automated ticketing, enrichment, and escalation.
Engineer SOAR playbooks to automate repetitive SOC tasks (e.g., IOC lookups, containment, notifications).
Integrate external threat feeds and CVE databases with internal asset inventories to support proactive vulnerability detection and patch prioritization.
Improve existing scripts, enrichment logic, and event correlation rules to reduce false positives and increase automation coverage.
Support the development of monitoring infrastructure (e.g., Fluentd, OpenTelemetry pipelines) with a security context.
Collaborate with DevOps, system owners, and analysts to ensure tooling is effective, resilient, and context-aware.
Ensure all automation aligns with internal policy and frameworks such as IT-Grundschutz, ISO 27001:2022, and C5:2022.
Provide engineering support during security incidents to build ad hoc response tooling or log aggregations and act as Tier 2 support for Cyber Security Analysts, including support of on-call duties, where necessary.
Ensure accuracy and continual improvement of related documentation, where applicable.

Requirements:

Bachelor's degree in Cybersecurity, Computer Engineering, or related technical field; equivalent experience also accepted.
Strong development/scripting experience with Python, Go, or Bash.
Experience designing and maintaining integrations between security platforms (SIEM, SOAR, threat intelligence platforms, ticketing systems).
Familiarity with SOAR tools such as Cortex XSOAR, Splunk SOAR, Tines, TheHive/Cortex, or similar.
Experience with cloud-native environments (e.g., Azure, AWS, or GCP), including APIs and identity models.
Strong knowledge of containerized environments (e.g., Docker, Kubernetes) and securing them.
Understanding of vulnerability management processes, CVE/CVSS standards, and real-world patching challenges.
Ability to build RESTful API integrations and data pipelines for security use cases.
3–5 years in a cyber security engineering or DevSecOps role.
Experience working in or supporting a SOC.
Familiarity with infrastructure-as-code (e.g., Terraform), GitOps pipelines, and securing CI/CD workflows.
Exposure to regulated environments (IT-Grundschutz, C5, ISO 27001, PCI-DSS, TISAX, KRITIS, etc.).