Defensive Security Engineer (IR)

We’re Adevinta, a global leader in digital marketplaces. Our household name brands, including Kleinanzeigen and mobile.de in Germany, Marktplaats in the Netherlands and Leboncoin in France, reach hundreds of millions of people every month. We’re all about matchmaking, and our sites help people find whatever they’re looking for in their local communities – whether it’s a car, an apartment, a sofa or a new job. Every connection made or item found makes a difference by creating a world where people share more and waste less. Our brands are supported by global Tech Hubs in Barcelona, Amsterdam, Paris and Berlin. Their goal is to develop common global products and innovation platforms which all of our brands can use. This means using cutting edge technology to create highly scalable, customisable and secure products and components that free up development time and leverage our access to global data.

We are looking for an experienced defensive security engineer with hands-on expertise in incident response and security operations in large enterprise environments. Comfortable working autonomously across the full incident response lifecycle - preparation, detection, analysis, containment, eradication, recovery and learning - and able to lead or support response efforts under pressure. Should have solid experience operating and enhancing defensive security technologies including EDR, SIEM, DLP, NIDS and threat intelligence solutions. Must be able to develop and refine incident response policies, playbooks, escalation procedures and tabletop exercises, and contribute to post-mortem analyses that feed back into detection and response improvements. Skilled at gathering, analysing and operationalising threat intelligence to strengthen detection and prevention

Adevinta's defensive security operates across three tiers: the SOC (MSSP, SCASSI) handles L1 triage, Core Defense provides L2 incident response, and Cloud Defense acts as L3 specialist escalation for cloud and platform-level investigations. While the SOC is gaining traction into the environment, SIEM coverage and maturity are increasing across marketplaces through the multi-tenant expansion, and new signals from tools like Wiz are adding scope and depth to the cloud security telemetry flowing into the platform. Together, these developments are driving a growing volume and complexity of security events that require deep technical investigation at the L3 level.

Cloud Defense is the team that provides specialist escalation when incidents involve cloud infrastructure, platform-level systems or require advanced containment and eradication actions. This engineer will strengthen that L3 capability by leading deep investigations into cloud and platform incidents escalated from Core Defense, developing and refining cloud-specific playbooks and escalation procedures aligned with the priority framework, participating in the on-call rotation, and contributing to post-mortem analyses that improve detection and response over time. They will also operationalise threat intelligence by feeding it into the SIEM detection pipeline, and collaborate with Core Defense and SCASSI to ensure escalation paths and coordination channels work effectively across all three tiers. Must be aligned with a GitOps and defense-as-code approach: managing detection content, security configurations, playbooks and operational tooling as versioned code in Git, with peer reviews, automated testing and repeatable deployments. Good understanding of AWS Cloud technologies, services, security capabilities and controls (SCPs, Security Groups, IAM). Familiar with SDLC and modern tooling and ecosystems such as Kubernetes, GitHub, GitHub Actions, CI/CD pipelines and infrastructure as code. Experience with security frameworks and methodologies such as MITRE ATT&CK or NIST. Familiar with Incident Management At Google (IMAG) and Agile methodology. Strong analytical and problem-solving skills with the ability to synthesise complex data into actionable insights. Fluent in English. 4+ years in a security engineering, SOC or incident response role.

Nice to have: public or private presentations, open-source contributions, certifications, participation in bug bounty programs, CTF competitions or ethical hacking communities. Life at Adevinta comes with its perks! Our Adevintans enjoy the following benefits:

• An attractive Base Salary

• Participation in our Short-Term Incentive plan (annual bonus)

• Work From Anywhere: Enjoy up to 20 days a year of working from anywhere! Maybe not from the moonwell why not! just make sure you have internet connection!

• A 24/7 Employee Assistance Program for you and your family, because we care ‍

• Win together, lose together is one of our key behaviours. At Adevinta you will find a collaborative environment with an opportunity to explore your potential and grow On top of these, we also provide a range of locally relevant benefits. Wanna know more? Apply and ask our recruiters! Adevinta is an equal opportunity employer and we value diversity. We do not discriminate on the basis of race, religion, colour, national origin, gender, sexual orientation, age, marital status or disability status.

If you feel like you don’t meet all of the requirements for this role but are interested, please consider applying anyway. Research suggests that women and individuals from underrepresented groups may self-select out of opportunities if they don’t meet 100% of the job requirements. We strongly encourage people from historically excluded groups to apply and look forward to speaking with you.