IT-Security Analyst - Cyber Defense Center (CDC) 80 - 100 %

As the largest university in Switzerland, the Universität Zürich offers a variety of attractive positions in different subject areas and professional fields. With around 10'000 employees and currently 12 professional profiles for apprentices, the university offers an inspiring working environment in cutting-edge research and education. Use your talent and your skills with us. Learn more about the UZH as an employer! ###

Tasks

As an IT-Security Analyst in the Cyber Defense Center, you monitor and analyze security-relevant events from different sources, perform in-depth analyses and initiate appropriate protective and counter-measures if necessary.
Your tasks include particularly:

• Analysis, triage and processing of security alerts and incidents from SIEM, Microsoft Defender XDR, endpoint, network, identity, cloud and other security sources
• Conducting in-depth analyses and threat hunting in the Microsoft Defender Portal, especially using Advanced Hunting and KQL or other tools in our SIEM
• Correlation and evaluation of events across different systems, log sources and security products
• Investigation of suspicious activities, attack indicators and possible compromises as well as initiation of appropriate incident response measures
• Blocking and managing Indicators of Compromise (IOC) such as IP addresses, domains, URLs or hashes etc.
• Further development of detection, hunting and response use cases in the SIEM as well as within the Microsoft 365 and Defender security platform
• Development and optimization of KQL queries, detection rules, alerting logics and automations
• Collaboration in vulnerability management, particularly in the evaluation, prioritization and follow-up of identified vulnerabilities
• Continuous further development of our security monitoring, detection and response processes in the CDC
• Documentation of incidents, analyses and measures as well as collaboration in IT security reporting

Profile

For this demanding position, we are looking for an analytically strong, independent and trustworthy personality with enjoyment in technical security analysis, threat hunting and incident response.
You bring with you:

• Completed studies, vocational baccalaureate or higher education in the field of computer science, cyber security or a comparable qualification
• Practical professional experience in the field of security operations, SOC, CDC, incident response or IT security
• Very good knowledge in handling SIEM systems, security logs and detection use cases
• Good knowledge of the Microsoft Security platform, especially Microsoft Defender XDR, Defender for Endpoint, Microsoft 365 Security and Advanced Hunting
• Practical experience with KQL (Kusto Query Language) for analysis, correlation and detection of security-relevant events
• Experience in exposure management, including vulnerability management
• Sound knowledge in the areas of network, endpoint security, identity and cloud security as well as common attack and detection methods
• Experience in the analysis and processing of Indicators of Compromise (IOC) and security incidents
• Scripting knowledge, for example in PowerShell, Python or Bash, is an advantage
• Structured, exact and efficient way of working as well as good analytical and communicative skills
• Good German and English skills