Lead the day-to-day operations of our Cyber Defense Center (CDC)
Set the direction for effective monitoring, investigation, and incident response across all SOC tiers
Act as the primary interface to our Managed Security Service Provider (MSSP)
Serve as the L3 escalation point for complex alerts, incidents, and investigations
Coordinate and lead response to incidents across SOC tiers
Own the SIEM/SOAR detection lifecycle
Define threat hunting objectives, aligning them with the CDC’s strategic goals
Develop and produce monthly KPI dashboards and reporting to demonstrate SOC performance
Work with the engineering team to increase log coverage and overall visibility
Serve as Duty Operational Manager on a rotational on-call basis (24/7/365)

Degree in Computer Science, IT Security, or a related field, or equivalent work experience
Several years of experience in a Security Operations Center, incident response, or threat detection role, including senior/L3 responsibilities and team or vendor coordination
Excellent communication and stakeholder management skills, with the ability to translate technical findings for both technical and executive audiences
Experience in incident response, threat detection, or security monitoring, with expertise in detection and response workflows
Strong ability to work under pressure, prioritize critical incidents, make rapid decisions, and support on-call escalation
Hands-on experience with SIEM, SOAR, and EDR technologies, as well as a solid understanding of detection technologies such as IDS/IPS, DLP, and WAF
Understanding of security threats and attack frameworks such as MITRE ATT&CK and the Cyber Kill Chain
Ability and drive to review, manage and continuously improve vendor performance, contracting and metrics with clear accountability and follow-through
Experience leading threat hunting activities, including defining hypotheses, objectives, and measurable outcomes
Familiarity with EU cybersecurity regulations relevant to SOC operations (e.g., NIS2 Directive) is a plus
Professional certifications such as CISM, GCIA, GCIH, or CISSP are a plus
Fluency in English; German is a plus

Modern and cutting-edge technology stack with opportunities to experiment and innovate within a high-tech group
40-60% hybrid work option to provide flexibility and work-life balance
Annual flexible benefits that include cafeteria options, private health plans, and annual reward
Company parking space in the underground garage of the office building can be reserved
Opportunity to directly contribute to the development of innovative products through software delivery
working in a team composed of excellent teammates and a supportive lead who collaborate to guide and support professional development from day one

L3 SOC Internal Analyst

Key skills