Security Operations Engineer(PSIRT & Incident Response)-German

About Our Client

Our Client is a technology-driven company in the field of 3D printing, developing high-performance 3D printers as well as an integrated hardware and software ecosystem. Our products are used worldwide by both private users and professional customers. In the US, we are continuously expanding our local service and support operations and are looking for motivated talent to join our customer service team.

Role summary

This role is a Security Operations Engineer. You will own end-to-end management of the security response center (SRC) and bug-bounty program, liaise with white‑hat researchers, and manage the researcher community. You will triage security alerts and analyze active attacks, and serve as the primary on-call responder for off‑hours breaches. You lead incident containment, forensics preservation and escalation to limit blast radius and protect business assets.

Ideal Candidate

Hands‑on experience in vulnerability triage and incident response, familiar with SRC / bug bounty workflows. Able to grade vulnerabilities and drive remediation closure, analyze SIEM/EDR/WAF alerts, reconstruct attack chains with ATT&CK and assess impact. Comfortable with night on‑call; capable of containment, account governance and forensics preservation. Knowledgeable of white‑hat community operations and testing compliance. Strong judgement, communication and escalation skills under pressure. Working English and Mandarin for cross‑regional collaboration.

Key Responsibilities

1. Liaise with external white‑hat researchers (Vulnerability Bug Bounty / SRC Management)

Core Objective: Leverage external security researchers (white hats) as an extended “external brain” to complement internal security defenses and uncover blind spots in advance.

• Vulnerability Triage: Review submissions from white hats, rapidly validate authenticity and reproducibility, assess severity (P0–P4), and assign CVSS scores.
• Business Alignment & Closure: Escalate vulnerabilities to relevant engineering / DevOps owners, track remediation progress, perform fix validation, and drive issues to full closure.
• White‑hat Operations & Incentives: Design and refine bounty programs (points, cash rewards, gifts, public hall of fame), nurture the researcher community, and attract high‑quality contributors to submit impactful vulnerabilities continuously.
• Anti‑Phishing & Compliance: Define clear testing boundaries for external researchers (authorized scope; no exfiltration, no service disruption) to mitigate legal risk.

2. Security Incident Response Triage

Core Objective: Distinguish false positives from real attacks amid high volumes of alerts and emergent security incidents, and classify incidents by nature and severity.

• Alert Analysis: Investigate alerts from SIEM, EDR, WAF and threat‑hunting platforms to identify malicious activity such as anomalous login IPs, unauthorized API calls, WebShell uploads and reverse shells.
• Threat Correlation: Reconstruct attack chains via logs (Syslog, access logs, authentication logs, etc.) using the ATT&CK framework.
• Impact Assessment: Determine whether attackers have conducted lateral movement, exfiltrated sensitive data, or established persistent backdoors.

3. Lead First‑Line Incident Containment During After‑Hours / Night On‑Call

Core Objective: Act as the primary responder for off‑hours security breaches to contain threats rapidly and limit blast radius (e.g., stop ransomware propagation and mass data exfiltration).

• First Responder Decision‑Making: Issue containment orders upon receiving after‑hours incident alerts.
• Containment Actions:
• Network Isolation: Block malicious IPs via security groups / firewalls; take compromised cloud or physical hosts offline.
• Account Governance: Disable compromised accounts and enforce password resets for high‑privilege accounts.
• Service Blocking: Temporarily shut down compromised microservices or web application modules.
• Forensics Preservation: Capture memory dumps, critical logs and suspicious artifacts before or after isolation to preserve evidence for later root‑cause analysis.
• Communication & Escalation: Update security and business stakeholders per response playbooks; activate the war room when required.

Key Requirement

• Technical Skills: Solid knowledge of major operating systems and TCP/IP networking. Able to triage SIEM / EDR / WAF alerts, reconstruct attack chains using logs and the ATT&CK framework, grade vulnerabilities with CVSS scoring and drive remediation closure. Experienced in incident containment and forensics preservation, with security governance experience on AWS / GCP.
• Security & Scripting: Understand compliance rules and authorized testing boundaries for external researchers. Basic automation skills with Shell / Python; capable of alert triage, threat containment, account governance and incident escalation.
• Language & Soft Skills: Working proficiency in English and Mandarin. Strong ability to work under pressure, with sharp security judgement, effective cross-team communication and disciplined escalation habits. Comfortable with night on‑call rotation.
• Education & Experience: Bachelor’s degree in Computer Science, Information Security or related field preferred. Equivalent professional experience will be considered in lieu of a degree. Hands‑on experience in vulnerability triage and security incident response; prior exposure to SRC / bug bounty programs is a plus.

Compensation & Immigration Information

Pay Scale: $88,000 – $140,000 annual base salary plus Benefit & Equity

Work Authorization: We welcome all applicants legally authorized to work in the United States. The company is eligible and willing to sponsor H-1B work visas for qualified international candidates; H-1B transfers from existing employers are also accepted.