Security Monitoring Expert (m/f/d) ID27155-2

Job Description Security Monitoring Expert (m/f/d) ID27155-2 Duration: 21.09.2026 – 31.03.2027 Volumen: 40h/week Location: remote Please submit your profiles in English! Project description: “Defending the Castle” is the short-term and immediate phase of our customers AI threat resilience response. The purpose is to buy time by increasing detection, response, containment and recovery readiness while a broader Phase 2 plan is prepared for the rest of the Business IT units. Task description: - Conceptual development and structured implementation of the short-term security monitoring strategy for “Defending the Castle”, focused on detecting AI-augmented threats across hybrid Azure and on-premise environments. - Translation of frontier-model driven threat scenarios into actionable detection logic, monitoring requirements, telemetry gaps, alerting rules and escalation criteria. - Provision of technical consultation and recommendations to SOC, Cyber Defense Center, incident response, threat intelligence, cloud, identity, endpoint and platform teams to improve detection coverage at machine-speed threat tempo. - Definition and validation of monitoring use cases for lateral movement, privilege escalation, identity abuse, cloud control-plane abuse, data staging, exfiltration and persistence across Azure zones and on-premise networks. - Production of playbooks, SOPs and tuning guidance that allow monitoring teams to detect, triage and escalate AI-assisted attacks with reduced ambiguity and consistent quality. - Establishment and technical definition of measurable detection coverage, alert quality and response-readiness metrics to support Q1 2027 completion and readiness for Phase 2. - Creation of immediate visibility into the most likely AI-accelerated attack paths affecting identity, cloud, endpoint, network and privileged access layers. - Optimization and technical evaluation of telemetry, correlation, enrichment, and alert prioritization for detection efficiency. - Provision of practical runbooks for SOC and monitoring teams that can be executed under pressure without relying on individual tribal knowledge. - Conceptual strengthening and technical enhancement of early-warning capability before a broader business IT resilience programme is launched. Quality - Technical peer review of detection logic across SOC, incident response and platform functions. - Execution and technical documentation of Purple-team exercises and tabletop scenarios, including simulated alert generation and escalation testing. - Compilation of an evidence pack containing detection catalog, data-source matrix, runbooks, tuning history and open risk register. - Preparation of documentation to facilitate operational sign-off from SOC lead, Cyber Defense lead and relevant Azure/on-prem service owners. - Identification and technical gap analysis of existing processes (too slow, fragmented, undocumented or dependent on informal knowledge) to document optimization potential. - Transformation of risk evaluations into executable playbooks, technical control frameworks, test protocols, backlog items and management evidence. - Provision of a structured handover of a Phase 2 backlog and recommendations for the broader Business IT resilience plan after Q1 2027. - Creation of comprehensive documentation with all results regarding the above-mentioned tasks with subsequent handover to Uniper for review and approval for further usage. Skills: Please submit profiles in english for the Security Monitoring Expert. • Minimum 8 years in cyber defense operations, SOC engineering, detection engineering, threat hunting or security monitoring. • Strong expertise in SIEM, XDR, EDR, Microsoft Sentinel or equivalent platforms, KQL/SPL-style query languages and cloud/security telemetry. • Good understanding of Azure security monitoring, Entra ID, hybrid identity, endpoint telemetry, network logs, MITRE ATT&CK and attack-chain analysis. • Experience creating operational runbooks, alert tuning processes and SOC quality metrics. • Relevant certifications such as GCIA, GCIH, GCDA, SC-200, AZ-500, CISSP or equivalent are beneficial.