Job description:

Do you want to do more than just perform security monitoring, but actively improve it?

Are you familiar with Elastic or Microsoft Sentinel, understand log data, and develop use cases that actually work in everyday SOC operations? Then you're a great fit for us.

At eyeDsec, you'll work on modern SIEM and SOC topics and support companies in detecting security incidents early, classifying them correctly, and handling them professionally. The annual salary for a junior position is €40,000–€60,000 gross, and for a senior position, it's €60,000–€90,000 gross.

Your responsibilities:

- Connecting log sources from Windows, Linux, firewalls, proxies, EDR/XDR, cloud, networks, and identities to Elastic and/or Microsoft Sentinel.

- Developing, testing, and continuously optimizing detection use cases for real-world attack scenarios.

- Analyzing security incidents, evaluating anomalies, and deriving appropriate measures.

- Review and improve data quality, parsers, normalization, field mapping, and alerting logic.

- Reduce false positives and refine existing detection rules based on practical experience.

- Optimize SIEM performance, data volume, queries, and cost aspects.

- Document use cases, analysis paths, and technical adjustments in a traceable manner.

- Collaborate with internal teams and customers and further develop SOC/SIEM processes.

Your profile:

- Professional experience in SIEM, SOC, security monitoring, detection engineering, or incident analysis.

- Experience with Elastic and/or Microsoft Sentinel as well as production SIEM environments.

- Solid understanding of log sources, detection rules, use cases, and incident analysis.

- Ability to technically reconstruct attacks and identify traces in log data.

- Analytical thinking, structured work style, and a high degree of independence.

- Good understanding of IT infrastructures, networks, Windows/Linux, and cloud services.

- Clear communication with technical teams, customers, and internal contacts.

Nice to have:

- KQL, EQL, Lucene, Sigma, or comparable query/detection languages.

- Microsoft Defender XDR, Azure, Sysmon, firewall, proxy, EDR/XDR, or network logs.

- MITRE ATT&CK, incident response, threat intelligence, or vulnerability management.

Experience in customer projects, managed security services, or SOC environments.

Benefits:

Remote or hybrid work, 30 days of vacation, and attractive compensation.

Short decision-making processes, autonomy, and exciting security projects.

Professional development in SIEM, SOC, and detection engineering.

Additional benefits such as Edenred, JobRad (company bike leasing), internet allowance, and childcare allowance.

Sounds like your next step?

Then apply today by email and please state your earliest possible start date. We look forward to getting to know you.

Content: © Federal Employment Agency – Reference number: 10001-1003437163-S