Cyber Defense Specialist (f/m/x)

RBI is fostering its Business by strengthening its information and cyber security capabilities for the next generation.

As a crucial part of Raiffeisen Bank International’s Group Cyber Defense Center, this function develops detection and prevention mechanisms to support our digitalization journey and maintain our customers’ confidence.

In this position, you will be a member of our Group SOC team. This includes providing effective security monitoring through triage, investigation, communication and reporting. You will be encouraged to conduct your own threat hunting investigations, create and refine detection use cases, and build tactical and strategic mitigation plans that measurably improve our security posture. You will work together with IT and security engineers to onboard bank products and build the cyber security use cases needed to protect them. You will also work hands-on with the AI-assisted and semi-autonomous tooling we are introducing across the SOC, and your judgement will shape how far we take it.

What you can expect:

• Enhance threat intelligence by leveraging technology and information available from both internal and external sources

• Perform threat management and threat modelling, identify threat vectors, and develop use cases for security monitoring

• Analyze and assess damage to data and infrastructure resulting from security incidents, examine available recovery tools and processes, and recommend solutions

• Validate and tune your own detection use cases by safely reproducing attacker techniques in our lab environment — we expect you to know what your rules look like when they fire

• Take part in purple team exercises with our Adversary Simulation colleagues and turn observed attack behavior into reliable detection logic

• Review the results of automated attack simulation runs and translate detection coverage gaps into concrete tuning and engineering tasks

Where we are going with AI:

RBI has its own AI strategy, and we are deliberately building towards an agentic SOC: analysts supported by semi-autonomous processes covering enrichment, correlation, use-case quality assurance, threat hunting support and reporting. We are hiring people who want to shape that, not watch it happen.

• You will work with AI-assisted triage, hunting and reporting from day one, and your feedback on where it helps — and where it is confidently wrong — will directly steer how we build it

• You will help develop detection coverage for the bank’s own AI adoption: our monitoring scope now includes AI and LLM workloads, not just traditional infrastructure

• We would rather you automate your repetitive work than do it twice — contributions to detection-as-code and SOAR playbook development are explicitly part of the role

What you bring to the table:

• Hands-on experience in security monitoring and incident detection within a Security Operations Center

• Strong understanding of the MITRE ATT&CK framework, the Cyber Kill Chain and other attack models

• Hands-on experience configuring, maintaining and improving SIEM platforms

• Practical understanding of how common attack techniques are executed — we value analysts who can reproduce a technique in a lab and recognize the traces it leaves in telemetry, rather than knowing it only from a framework

• Ability to write Python or PowerShell scripts to automate tasks, enrich security data and validate detections

• Practical experience using LLM-based tools in your daily work, including effective prompting, recognizing unreliable output and verifying results before acting on them

• Familiarity with common offensive tools (e.g. BloodHound, Impacket, Mimikatz and C2 frameworks) and the forensic artefacts they leave behind is an asset

• Experience running ATT&CK-aligned tests using tools such as Atomic Red Team or Caldera, or working with breach and attack simulation platforms, is an asset

• Experience working with cyber threat intelligence (CTI) platforms is an asset

• Awareness of security risks associated with AI and LLMs, such as prompt injection and data leakage, and familiarity with the OWASP Top 10 for LLM Applications are assets

• Vendor-independent security certifications (e.g. CISA, CRISC, CISSP or CEH) are an asset

• A hands-on offensive security certification (e.g. OSCP or GPEN), or equivalent experience with advanced labs such as Hack The Box Pro Labs, is a welcome addition — but this is a defensive role, not a full-time penetration testing position

What’s in it for you:

• Work-Life-Balance: Flexible hours, work-from-home options from Austria
• Global community: 75+ nationalities, English as the company language, and work permit support. Our teams thrive on collaboration and mutual respect.
• Career growth: We believe in continuous learning and proactive career development. Take on challenging work that stretches your abilities, attend trainings, and use new technologies to make a lasting impact.
• Stay healthy: Subsidized canteen, well-being programs, check-ups, and sport allowances.
• Save money: Discounts, exclusive banking terms, and a free public transport pass.
• Family support: Child allowances, gender-neutral parental leave, bilingual company kindergarten, and holiday childcare.
• Competitive salary: In accordance with Austrian legal requirements, the minimum salary for this position is EUR 3.375,40 gross per month under the applicable Banking Collective Agreement. The actual salary is typically higher and will be determined individually based on your qualifications, professional experience, and the specific requirements of the role.