Cybersecurity Automation Engineer SOC SIEM/SOAR (m/f/d)

Job Description T-Systems, a leading multinational in Information and Communication Technologies, needs to hire a Cybersecurity Automation Engineer in Madrid, Barcelona or Granada. You will belong to the T-Systems Cybersecurity area, which brings together IT_Security, Network_Security and Cybersecurity SOC services. Specifically, it will be part of the T-Systems SOC. Its main function will be to support the automation of SOC operations that are being carried out in the area through the use and integration of multiple tools that support SOC processes.

To this end, as a cybersecurity engineer at the SOC, you will carry out tasks related to the implementation and maintenance of SIEM/SOAR platforms to analyze security events, configure alerts for proactive threat detection and collaborate in the adaptation of configurations. You'll use SOAR tools to automate incident responses, improving efficiency and effectiveness in cybersecurity operations. A deep understanding of cybersecurity principles and SIEM/SOAR systems is crucial for implementing effective automated solutions and improving defense against cyber threats.

Your main functions will be the following:

• Perform SIEM configurations and use cases: Develop and implement complex configurations within the SIEM system to ensure optimal detection and response capabilities, including correlation rules, filters, and data source integrations.

• Development of automations and playbooks in the SOAR: Develop custom scripts or automation workflows to improve the automation capabilities of the SOAR platform, allowing for more efficient incident response and mitigation.

• Integration of SOC tools through APIs to automate and improve the efficiency and effectiveness of SOC processes.

• Scripting and programming development: scripting in languages such as Python, PowerShell or Bash to develop custom scripts for automation, integration and data manipulation.

• Optimization: Continuously adjusting and optimizing the SIEM/SOAR modules to improve their effectiveness over time, adapting to changes in the threat landscape and organizational needs.

• Collaboration with SOC teams, Cybersecurity Architecture, CuSM, and other IT teams: You'll work closely with IT and other security teams to understand the organization's infrastructure, applications, and network architecture, ensuring effective SIEM/SOAR integration.

Requirements

Languages: Spanish, Middle English, valuable High English.

University education in technical or higher IT or telecommunications engineering or other similar technical qualification.

Highly valuable master's degree or specialization in cybersecurity or similar.

Demonstrable experience of at least 3 years in the field of cybersecurity, at least 2 of them in a SOC or similar in functions similar to those of the position.

Technical Knowledge

Cybersecurity fundamentals and basic knowledge:

• Security Principles: Confidentiality, Integrity and Availability (CIA).

• Types of Threats: Knowledge about malware, phishing, denial of service (DoS) attacks, APTs (Advanced Persistent Threats), TTPS (attack techniques and tactics), etc.

• Incident Analysis: Understanding the full lifecycle of incident management, from detection to remediation and post-incident reporting.

• Identification and Containment: Ability to quickly identify the nature of a security incident and take initial containment measures.

• Investigation: Ability to delve into the technical details of an incident, using logs, network traffic analysis, and forensic analysis tools.

• Cloud security: Familiarity with cloud computing environments (AWS, Azure, GCP) and experience in protecting cloud-based infrastructures and services.

Knowledge in Networks and Systems.

• Understanding network architecture and topologies.

• Knowledge of common protocols such as TCP/IP, HTTP, HTTPS, DNS, etc.

• Operating Systems: Familiarity with Windows, Linux and Unix operating systems.

• Event Log: Knowledge about event logging systems in different operating systems (for example, Event Viewer on Windows, syslog on Linux).

Knowledge and experience in SIEM (Security Information and Event Management)

• SIEM tools: Familiarity with SIEM tools. Very valuable knowledge and experience in SPLUNK SIEM and/or Azure Sentinel.

• Data Intake and Normalization: Understanding how record data is collected, normalized and stored.

• Rules and Event Correlation: Ability to create and adjust correlation rules to detect attack patterns and suspicious activities.

• Alert Analysis: Ability to analyze alerts and events generated by SIEM, identify false positives and prioritize incidents.

Knowledge and experience in SOAR (Security Orchestration, Automation, and Response)

• SOAR platforms: Experience with SOAR tools such as SPLUNK SOAR; Palo Alto Cortex XSOAR and/or XSIAM, automation in Azure Sentinel, etc.

• Workflow Automation: Knowledge in creating and managing automatic playbooks and workflows to respond to security incidents.

• Orchestration: Ability to integrate multiple security tools and systems using SOAR to improve incident response.

Knowledge in Automation and Scripting

• Scripting languages Python: Ability to write scripts in Python to automate security tasks.

• Bash/PowerShell: Experience with scripting in Bash (for Linux systems) and PowerShell (for Windows systems).

• Security APIs: Ability to interact with security tool APIs to integrate and automate workflows.

• Task Automation: Knowledge of how to automate repetitive tasks and workflows using scripting and automation tools.

SoftSkills Skills

• Interaction with Teams: Ability to communicate effectively with other technical teams.

• Ability to write reports and documentation within the scope of their functions and tasks.

Problem Solving

• Critical Thinking: Ability to address and solve complex security problems.

• Adaptability: Ability to adapt to new threats and emerging security technologies.

Additional Information

What do we offer you?

• International, positive, dynamic and motivated work environment.

• Hybrid work model (teleworking/face-to-face).

• Flexible schedule.

• Ongoing training.

• Flexible compensation plan.

• Life and accident insurance.

• More than 25 working days of vacation per year.

And many more advantages of being part of T-Systems! If you are looking for a new challenge, do not hesitate to send us your CV. Join our team! T-Systems Iberia will only process the CVs of candidates who meet the requirements specified for each offer.

Your Task

T-Systems, a leading multinational in Information and Communication Technologies, is hiring a Cybersecurity Automation Engineer for their Madrid, Barcelona or Granada locations. This position is part of the T-Systems Cybersecurity area, specifically within the T-Systems SOC (Security Operations Center). The role focuses on supporting the automation of SOC operations through the use and integration of multiple tools that support SOC processes.

As a cybersecurity engineer at the SOC, you will implement and maintain SIEM/SOAR platforms to analyze security events, configure alerts for proactive threat detection, and collaborate in adapting configurations. You'll utilize SOAR tools to automate incident responses, improving efficiency and effectiveness in cybersecurity operations. A deep understanding of cybersecurity principles and SIEM/SOAR systems is essential for implementing effective automated solutions and improving defense against cyber threats.

Responsibilities

• Perform SIEM configurations and use cases: Develop and implement complex configurations within the SIEM system to ensure optimal detection and response capabilities, including correlation rules, filters, and data source integrations.

• Develop automations and playbooks in SOAR: Create custom scripts or automation workflows to improve the automation capabilities of the SOAR platform, allowing for more efficient incident response and mitigation.

• Integrate SOC tools through APIs to automate and improve the efficiency and effectiveness of SOC processes.

• Develop scripts and programs: Write code in languages such as Python, PowerShell or Bash to develop custom scripts for automation, integration and data manipulation.

• Optimize systems: Continuously adjust and optimize the SIEM/SOAR modules to improve their effectiveness over time, adapting to changes in the threat landscape and organizational needs.

• Collaborate across teams: Work closely with SOC teams, Cybersecurity Architecture, CuSM, and other IT teams to understand the organization's infrastructure, applications, and network architecture, ensuring effective SIEM/SOAR integration.

Your Profile

We are looking for a Cybersecurity Automation Engineer with experience in SOC operations, SIEM/SOAR platforms, and automation scripting to support and enhance cybersecurity operations.

Must Have Skills

• Spanish language proficiency (middle level)

• University education in IT, telecommunications engineering, or similar technical qualification

• At least 3 years of experience in cybersecurity

• At least 2 years of experience in a SOC or similar environment

• Knowledge of cybersecurity fundamentals (CIA principles)

• Understanding of threat types (malware, phishing, DoS attacks, APTs, TTPs)

• Experience with incident analysis, identification, containment, and investigation

• Knowledge of network architecture, topologies, and common protocols (TCP/IP, HTTP, HTTPS, DNS)

• Familiarity with Windows, Linux, and Unix operating systems

• Knowledge of event logging systems

• Experience with SIEM tools

• Understanding of data intake, normalization, rules, and event correlation

• Ability to analyze alerts and identify false positives

• Experience with SOAR platforms

• Knowledge of workflow automation and orchestration

• Scripting skills in Python

• Experience with Bash/PowerShell scripting

• Ability to interact with security tool APIs

• Effective communication skills with technical teams

• Report writing and documentation abilities

• Critical thinking and problem-solving skills

• Adaptability to new threats and emerging security technologies

Nice to Have Skills

• High level English language proficiency

• Master's degree or specialization in cybersecurity

• Knowledge and experience with SPLUNK SIEM and/or Azure Sentinel

• Experience with cloud security (AWS, Azure, GCP)

• Experience with specific SOAR tools (SPLUNK SOAR, Palo Alto Cortex XSOAR/XSIAM, Azure Sentinel automation)