Security Engineer (SOC)

Stack

Responsibilities

• ▹Build, operate and further develop SOC platforms (SIEM, SOAR, EDR/XDR)
• ▹Onboard new log sources, including parsing, normalisation and ensuring data quality
• ▹Develop and optimise detection rules and use cases (Sigma, KQL, SPL) based on MITRE ATT&CK
• ▹Automate analysis and response processes with playbooks and scripting (Python, PowerShell)
• ▹Build detection-as-code pipelines including versioning, testing and CI/CD
• ▹Integrate and operationalise threat intelligence
• ▹Work closely with analysts and incident responders to reduce false positives and improve detection quality
• ▹Provide technical support during security incidents
• ▹Create runbooks, use case documentation and technical concepts
• ▹Use AI-assisted tools for log analysis, rule and playbook drafts and documentation, including expert validation and approval of the results

Requirements

• ▹Confident use of AI tools in consulting work, including critical assessment of the results
• ▹Strong awareness of confidentiality when using AI: knowing which data may go into which system and understanding the risks (data leakage, model training, prompt injection)
• ▹Willingness to continuously develop processes and products with AI
• ▹At least 5 years of experience in IT/cyber security, of which several years in architecture or consulting roles
• ▹Broad technology understanding across network, endpoint, identity, application and cloud
• ▹Experience with zero trust and segmentation concepts as well as IAM/PAM (Entra ID, Active Directory)
• ▹Solid command of ISO 27001, BSI IT-Grundschutz, NIST CSF, MITRE ATT&CK, SABSA/TOGAF
• ▹Knowledge of cryptography, PKI and secure application design
• ▹Business-fluent German and English

Nice to have

• ▹Cloud architect know-how: design, security and operation of cloud and hybrid environments (Azure, AWS, GCP), cloud-native security services, infrastructure-as-code
• ▹Experience with prompt engineering, AI agents or LLM integration in workflows
• ▹Knowledge of AI governance (EU AI Act, ISO/IEC 42001, OWASP Top 10 for LLM)
• ▹Experience in regulated environments (KRITIS, financial sector, industry/OT)
• ▹Certifications: OffSec OSDA (SOC-200), OSCP (PEN-200), SANS/GIAC GCDA (SEC555), GDSA (SEC530), GCIH (SEC504), SANS SEC586 (Blue Team Automation), Microsoft SC-200

Soft skills

What we offer

• ▹Fixed salary from €80,000 plus profit sharing of up to €70,000
• ▹Flexible working hours, remote work, 30 days of vacation
• ▹IT equipment such as an Apple MacBook
• ▹Regular team events
• ▹Company pension scheme and health insurance, shopping and employee discounts
• ▹Location-independent work

About the company

APT-ONE GmbH is a Berlin-based cyber security consultancy protecting its clients' IT, OT, cloud and AI systems. AI tools handle discovery and routine analysis, while the consultants validate and interpret the results.