Senior Cyber Security Engineer - Focus on Incident Response and Threat Intelligence (all)

Senior Cyber Security Engineer - Focus on Incident Response and Threat Intelligence (all) # 80-100% in Winterthur ## The rapid detection and treatment of cyber attacks is more important than ever; it requires a strong defence architecture, modern detection solutions, a reliable and modern Security Operations Center, and people who take responsibility. This is exactly where you come into play. As a Senior Cyber Security Engineer with a focus on Incident Response and Threat Intelligence, you will take on a central role in the Cyber Security team of SWICA. Thanks to our Work-Anywhere regulation, you will work flexibly throughout Switzerland, combined with personal exchange at our headquarters in Winterthur. How you shape health with ### • Optimization of processes for the detection, analysis, and treatment of security incidents and cyber threats, as well as implementation of measures for the continuous increase of team maturity • Independent processing and coordination of security incidents (Incident Handler) as well as creation and presentation of situation reports and recommendations for action for management • Coordination and management of internal stakeholders and the external SOC and CSIRT partner • Execution of technical analyses, threat hunting, and incident response activities • Further development and automation of SIEM use cases and runbooks to improve security monitoring together with the SOC provider • Development of cyber security playbooks and pre-approved containment measures • Support and execution of blue team exercises to strengthen defensive security measures What distinguishes you ### • Education or studies in computer science or information security • Quick comprehension and ability to break down complex issues into solvable work packages • At least 3 years of practical experience in the field of cyber security, especially in incident response, incident handling, threat intelligence • Profound knowledge of modern attack vectors, security frameworks, and relevant tools e.g. SIEM / SOAR (MS Sentinel), XDR (MS Defender) • Certifications such as GIAC GSOM, GIAC GCIH, CERT CSIH, OSCP or comparable are an advantage • Scripting and automation skills (e.g. Python, PowerShell), experience with Infrastructure as Code or security automation is an advantage • Experience in handling complex cyber security incidents as well as communication to technical and non-technical target groups • You are used to working with and leading external partners • Structured, analytical, and independent way of working • Enjoyment in conveying technical topics in an understandable way and taking professional responsibility • Confident German in spoken and written form and very good English skills Your place of work ### Zürcherstrasse 31, 8401 Winterthur