Cyber Defence Analyst L2

This position is based in our specialized Cyber Defense Center for Managed Security Services. Together we ensure 24/7 security monitoring and provide robust, future-proof digital defense against complex cyberattacks.

• Monitoring SOAR, SIEM, EDR/XDR and network telemetry to detect anomalies, policy violations and attacker techniques (MITRE ATT&CK)
• Carrying out sound technical analyses, documentation and triage of security events and alerts
• Investigating security incidents using threat intelligence and vulnerability assessments
• Carrying out first defensive containment measures
• Supporting threat hunting activities using cyber threat intelligence inputs
• Supporting detection engineering with suggestions for rule optimization and playbook updates based on recurring alerts
• Creating and updating security use cases and operational playbooks
• Creating required documentation and presenting work results

• The job requires knowledge and skills usually gained through a relevant, completed vocational training of at least three years in IT and extensive specialist additional qualification. Knowledge and skills usually gained through qualified further training (e.g. technician, business administrator) are treated as equivalent. This also includes master craftspeople or specialist business managers with additional duties such as leadership tasks and professional responsibility for subordinate staff. The required knowledge and experience as a whole may have been gained in other ways
• Practical knowledge of security monitoring platforms (e.g. Splunk, Microsoft Sentinel), EDR/XDR solutions (e.g. Microsoft Defender XDR, HarfangLab, Palo Alto Cortex XDR) and log analysis tools
• Ability to analyze raw logs (syslog, firewall, DNS, proxy, authentication) and to perform basic packet inspection
• Practical knowledge and experience in security analysis
• Solid understanding of network protocols, operating system internals (Windows & Linux), Active Directory and common attack techniques (MITRE ATT&CK framework)
• Certifications such as Microsoft SC-200, Splunk Core User, Splunk Power User, Splunk Certified Cybersecurity Defense Analyst, Blue Team Level 1, Blue Team Level 2, Palo Alto certifications, CISSP, CEH, GCIH or GCFA are a plus
• Very good German and English skills, spoken and written
• This job requires a security clearance, or one must be granted by the responsible authorities