Staff Security Engineer, GSOC

Stack

Responsibilities

• ▹Architect, implement and scale the Security Log Management (on AWS), SIEM and SOAR (Google SecOps) infrastructure, owning the log ingestion pipelines for high availability, performance and retention.
• ▹Build and maintain detection rules (e.g., YARA-L), API integrations and SOAR workflows and plugins using a 'Detection as Code' approach, version-controlled and deployed via CI/CD.
• ▹Establish and integrate Cyber Threat Intelligence, mapping detections to the MITRE ATT&CK framework and proactively hunting for threats.
• ▹Design high-fidelity alert triage and escalation workflows that enrich events and escalate validated incidents to the CSIRT team.
• ▹Serve as the primary interface between the Global SOC and Engineering teams, CISOs and the CSIRT team.
• ▹Mentor detection engineers and regional security teams to raise the overall technical bar.
• ▹Define, track and improve core operational metrics (log pipeline health, alert fidelity, true positive rates, MTTD).
• ▹Participate in an on-call rotation focused on SIEM/SOAR health, high-severity alert triage and emergency escalations.

Requirements

• ▹7+ years of broad cybersecurity experience, plus 5+ years dedicated to a SOC or threat detection engineering environment.
• ▹Deep operational and architectural expertise with modern SIEM & SOAR platforms (specifically Google SecOps / Chronicle), EDR and cloud infrastructure (AWS/GCP).
• ▹Proven experience with Git/GitHub and CI/CD pipelines to deploy rules and manage infrastructure and automation as code.
• ▹Strong background operationalizing Cyber Threat Intelligence and building scalable alert triage processes that reduce false positives.
• ▹Proven deep experience triaging alerts and building high-fidelity detections across public cloud (AWS/GCP), identity providers (Okta, Entra ID, Google Workspace) and EDR platforms (CrowdStrike, SentinelOne, Defender).
• ▹Exceptional communicator with the ability to influence cross-functional stakeholders without formal authority.

Nice to have

• ▹Experience integrating AI/LLM capabilities and MCP (Model Context Protocol) into threat detection and SOAR.
• ▹Experience building threat intel programs and managing intelligence platforms (e.g., MISP).
• ▹Deep understanding of global cybersecurity and privacy frameworks (PCI-DSS, GDPR, NIS2, DORA, MAS TRM).
• ▹Industry-recognized technical certifications (AWS Certified Security/Solutions Architect, GCIA/GCDA/GMON, CISSP).

Soft skills

What we offer

• ▹Hybrid working model with 2 days a week at the Berlin campus.
• ▹27 days holiday, with an extra day in the 2nd and 3rd year of service.
• ▹EUR 1,000 educational budget, language courses, parental support and Udemy Business access.
• ▹Health checkups, meditation, and gym & bicycle subsidy.
• ▹Employee Share Purchase Plan, sabbatical bank, public transport ticket discount, life & accident insurance and corporate pension plan.
• ▹Digital meal vouchers, food vouchers and corporate discounts.
• ▹Relocation support for moving to Berlin.

About the company

Delivery Hero is the world's pioneering local delivery platform, operating in around 65 countries and headquartered in Berlin, Germany. One of Europe's largest tech platforms, it has been listed on the Frankfurt Stock Exchange since 2017 and is part of the MDAX stock market index.