About the Role
We are building an ISO/IEC 27001-aligned information security management system, integrated with our ISO 9001 quality system, and preparing for NIS2. This is the first dedicated security engineering role in the Group: you will design and run a single Group-wide SOC, raise our technical security controls, and run internal technical security audits. It is a hands-on lead role: you build much of it yourself, then grow it with partners (MDR/MSSP) and, later, a team.
Responsibilities
•Design the SOC architecture and operating model; select and tune the SIEM (Wazuh / Microsoft Sentinel under evaluation)
•Write and maintain detections (KQL, Sigma, Wazuh rules); reduce false positives
•Lead technical incident response: triage, evidence, containment, root cause, lessons learned
•Harden Microsoft 365, Entra ID, Active Directory, Windows/Linux servers, network and backup
•Own vulnerability scanning and pentest follow-up with IT teams
•Plan and perform internal technical audits of IT controls; turn findings into tracked actions (audits of controls you built are performed independently)
•Manage security vendors (MDR/MSSP, pentesters) against SLAs
•Automate SOC work (Python / PowerShell, SOAR, AI-assisted triage within Group AI policy)
Requirements
•5+ years in technical security, incl. 2+ years in SOC, detection engineering or incident response
•Has built (not only operated) a SOC, SIEM or security monitoring process
•Deep Microsoft security: Entra ID, Conditional Access, PIM, Intune, Defender XDR, M365 audit logs, KQL
•Active Directory attack paths and hardening (tiering, BloodHound / PingCastle)
•Windows forensics and EDR telemetry; vulnerability scanners; CIS benchmarks
•Scripting in Python and/or PowerShell; Git
•Working knowledge of ISO/IEC 27001:2022 Annex A, NIS2 and GDPR incident notification
•English B2+ (all documentation in English)
Nice to have
•ISO 27001 internal / certification audit experience
•Multicountry group experience
•Microsoft Sentinel, Azure security, SOAR (Shuffle, TheHive, MISP)
•Certifications: SC-200 / SC-300, GCIH / GCFA, BTL, OSCP / CRTO, ISO 27001 LA
Conditions
•Work for a financially strong, fast-growing multinational company
•Access to continuous professional development: training, certification programs, events, and team buildings
•Competitive salary package and motivation scheme
•Work-from-home option
•International career opportunities
