Cyber Threat Detection Analyst / Engineer (f/m)

Visibility & Detection Gap Analysis: Conduct analyses of Cyber Threat Intelligence (CTI), attack surfaces, and the current detection landscape to identify and prioritize visibility and detection gaps.
Adversary Emulation: Perform adversary emulation and simulations to validate and continuously improve detection coverage.
Rule Development & Tuning: Develop, test, and tune high-fidelity detection rules and preventive controls to strengthen the overall security posture.
SOC Collaboration: Collaborate with SOC and incident response teams to streamline alert triage, optimize playbooks, and reduce false positives.
Professional Experience: Multiple years of experience in detection engineering/content development, threat hunting, or offensive security.
Technical Expertise: Deep expertise in the MITRE ATT&CK® framework, from converting hypotheses into MITRE-mapped adversary TTPs to evaluating potential visibility and coverage gaps.
Programming & Automation: Proficient in scripting and automation languages (e.g., Python, PowerShell, Bash) and proven experience in most commonly used query languages (e.g., KQL, SQL, Splunk SPL).
Certifications (Strong Plus): Offensive security certifications (e.g., OSCP, OSEP, CRTO, GXPN, GPEN, GCIH or other relevant GIAC/offensive certifications).
Threat Intelligence & SOC: Familiarity with or formal training in Cyber Threat Intelligence (CTI) and/or SOC Analyst experience (e.g., Microsoft SC-200) is a strong asset
Soft Skills & Language: Analytical, structured, and investigative mindset; fluent English is a must (German or other European languages are a plus).

Employment type
Full-time

Work arrangement
Hybrid