Security Engineer (SOC) (m/w/d)

About This Opportunity

We are representing a confidential cybersecurity consultancy in Berlin seeking a Security Engineer to focus on Security Operations Center (SOC) platforms and detection engineering. Our client protects critical IT, OT, cloud, and AI systems through advanced detection capabilities and automation.

This role centers on detection engineering: building and optimizing SIEM and XDR platforms, developing detection-as-code pipelines, and automating security operations. You'll work with KQL, Sigma, and MITRE ATT&CK frameworks while leveraging AI-assisted tools within strict data protection boundaries.

The position is remote-friendly and based in Berlin, offering significant autonomy to work on high-impact projects in security operations.

Responsibilities

• Design, operate, and continuously improve SOC platforms including SIEM, SOAR, and EDR/XDR solutions
• Onboard new log sources with proper parsing, normalization, and data quality assurance
• Develop and optimize detection rules and use cases using Sigma, KQL, and SPL based on MITRE ATT&CK
• Automate analysis and response processes through playbooks and scripting (Python, PowerShell)
• Build detection-as-code pipelines with version control, testing, and CI/CD integration
• Integrate and operationalize threat intelligence feeds
• Collaborate closely with analysts and incident responders to reduce false positives and improve detection quality
• Provide technical support during security incidents
• Create runbooks, use case documentation, and technical architecture concepts
• Employ AI-assisted tools for log analysis, rule development, and playbook design while validating all outputs

What We're Looking For

Required:

• Minimum 5 years of experience in IT/cybersecurity, with several years in architecture or consulting roles
• Proficiency with AI tools in professional settings, including critical evaluation of outputs
• Strong awareness of data confidentiality when using AI: understanding which data can enter which systems and recognizing risks (data leakage, model training, prompt injection)
• Commitment to continuously improving processes and deliverables using AI-based methods
• Broad technical understanding across network, endpoint, identity, application, and cloud domains
• Experience with Zero-Trust and segmentation concepts, plus IAM/PAM (Entra ID, Active Directory)
• Strong familiarity with ISO 27001, BSI IT-Grundschutz, NIST CSF, MITRE ATT&CK, SABSA/TOGAF
• Knowledge of cryptography, PKI, and secure application design
• Fluent German and English

Highly Valued:

• Cloud architecture expertise: design, security, and operation of cloud and hybrid environments (Azure, AWS, GCP), cloud-native security services, infrastructure-as-code
• Experience with prompt engineering, AI agents, or LLM integration in workflows
• Knowledge of AI governance frameworks (EU AI Act, ISO/IEC 42001, OWASP Top 10 for LLM)
• Experience in regulated environments (critical infrastructure, financial sector, industrial/OT)

Relevant Certifications (advantageous but not required):

• OffSec: OSDA (SEC-200 Defense Analyst), OSCP (PEN-200)
• SANS/GIAC: GCDA (SEC555), GDSA (SEC530), GCIH (SEC504), SEC586 (Blue Team Automation)
• Microsoft SC-200 (Sentinel, Defender XDR, KQL)

How We Work with You

When you apply through Get A Job.ai, our talent team will review your profile and conduct an initial screening. If there's a strong match, we'll submit your candidacy to our client for consideration. Please do not contact the client organization directly—all communication and coordination will flow through our recruitment team to ensure a smooth, confidential process.

Pay

Compensation details will be discussed during the screening process with our recruitment team.

Equal Opportunity: Get A Job.ai is committed to inclusive hiring practices. We welcome candidates from all backgrounds and work to ensure fair, equitable access to opportunities.