SecOps Analyst

Personio | HR technology

3h 53m ago

Hybrid

Full Time

Germany

Personio's intelligent HR platform helps small and medium-sized organizations unlock the power of people by making complicated, time-consuming tasks simple and efficient. Our team of 1,500 Personios is building user-friendly products that delight our 15,000+ customers and their 1.5 million employees. Ready to make an impact from day one?

The Role

Join us to shape the future of software in the underserved and high-impact HR technology industry. Your work will have a direct and tangible impact on customers, offering ownership and the chance to make a meaningful difference. As we prepare for significant growth, you'll face exciting challenges and have the opportunity to influence our path toward becoming one of the world's leading tech companies.
Security is a priority at Personio. We’re looking for an experienced Security Operations Analyst to join our Security organization and help us detect, investigate and respond to threats across production, corporate IT and AI tooling. You’ll work directly with SecOps Engineers and teams across the business to hunt for signs of compromise, improve our detections and playbooks, and lead the response when incidents happen.

What You’ll Do

Detection engineering: Work with SecOps Engineers to deploy and maintain high-quality detections on our SIEM platform.
Threat hunting: Review events and alerts, and proactively hunt for signs of compromise across production, corporate IT and AI tool feeds.
Alert and logging quality: Flag noisy or underperforming alerts and identify logging gaps, then work with SecOps Engineering to fix them.
Playbook development: Build out detection and response playbooks, find gaps in existing ones, and add new insights and automations so they stay current and effective.
Firefighting rotation: Act as the Security Team’s on-duty representative, answering inquiries from across the business and responding to urgent matters.
Incident response: Provide subject matter expertise support during Security Incident Response and Post Mortems, and drive the follow-up improvements.

What You Need to Succeed

3+ years in Cyber Security: Working knowledge of threat detection, incident response or similar functions. A BS in Computer Science, Information Security, or equivalent professional experience.
Threat landscape knowledge: Familiarity with threats facing cloud-based apps and SaaS providers, and with adversary TTPs (MITRE ATT&CK) and how to spot them in activity logs.
Data analysis: Strong skills in using SQL-like query languages on complex, high-volume data sets to find signs of compromise.
Incident leadership: Confidence leading large Security Incidents, coordinating responders across Security, Engineering, IT and Support, and giving executive-style updates to stakeholders.
Security tooling and forensics: Hands-on experience with SOAR, SIEM, threat intelligence tools, EDR and NGFW, plus securing and investigating AWS environments. Understanding of security forensics and log collection best practices.
Automation: Working knowledge of at least one scripting language, such as Python, and eagerness to build scripts and tooling and use AI effectively to automate operational tasks.
Communication: Excellent written and spoken English, with the ability to adapt your message for executive, technical, customer-facing and non-technical audiences.

Why Personio?

Personio is an equal opportunities employer, committed to building an integrative culture where everyone feels welcomed and supported. We embrace uniqueness and understand that our diverse, values-driven culture makes us stronger. We are proud to have an inclusive workplace environment that will foster your development no matter your gender, civil status, family status, sexual orientation, religion, age, disability, education level, or race.

At Personio, we value in-person collaboration while also offering flexibility. This role requires 2 days per month in the office and is based in required in your contracted office location: Munich/Berlin/Dublin/London/Barcelona/Madrid/Amsterdam. The remaining days can be worked from home or in the office if you prefer. In addition, you’ll have 20 Flex Days per year to work remotely from other locations.

Aside from our people, culture, and mission, check out some of the other benefits that make Personio a great place to work:

Receive a competitive reward package – reevaluated each year – that includes salary, benefits, and pre-IPO equity
Enjoy 28 days of paid vacation, plus an additional day after 2 and 4 years
Make an impact on the environment and society with 1 (fully paid) Impact Day
Receive generous family leave, child support, mental health support (including 24 sessions per year with Oli for yourself and 10 sessions for a significant other), and sabbatical opportunities
We enjoy gathering for meals, cultural initiatives, and events like local Summer Sessions and year-end celebrations. There's also healthy snacks, drinks, and a weekly catered lunch.

Required Skills

siemawssqlpython

Required Languages

🇬🇧 English

The Role

What You’ll Do

Detection engineering: Work with SecOps Engineers to deploy and maintain high-quality detections on our SIEM platform.

Threat hunting: Review events and alerts, and proactively hunt for signs of compromise across production, corporate IT and AI tool feeds.

Alert and logging quality: Flag noisy or underperforming alerts and identify logging gaps, then work with SecOps Engineering to fix them.

Playbook development: Build out detection and response playbooks, find gaps in existing ones, and add new insights and automations so they stay current and effective.

Firefighting rotation: Act as the Security Team’s on-duty representative, answering inquiries from across the business and responding to urgent matters.

Incident response: Provide subject matter expertise support during Security Incident Response and Post Mortems, and drive the follow-up improvements.

What You Need to Succeed

3+ years in Cyber Security: Working knowledge of threat detection, incident response or similar functions. A BS in Computer Science, Information Security, or equivalent professional experience.

Threat landscape knowledge: Familiarity with threats facing cloud-based apps and SaaS providers, and with adversary TTPs (MITRE ATT&CK) and how to spot them in activity logs.

Data analysis: Strong skills in using SQL-like query languages on complex, high-volume data sets to find signs of compromise.

Incident leadership: Confidence leading large Security Incidents, coordinating responders across Security, Engineering, IT and Support, and giving executive-style updates to stakeholders.

Security tooling and forensics: Hands-on experience with SOAR, SIEM, threat intelligence tools, EDR and NGFW, plus securing and investigating AWS environments. Understanding of security forensics and log collection best practices.

Automation: Working knowledge of at least one scripting language, such as Python, and eagerness to build scripts and tooling and use AI effectively to automate operational tasks.

Communication: Excellent written and spoken English, with the ability to adapt your message for executive, technical, customer-facing and non-technical audiences.

Why Personio?

Aside from our people, culture, and mission, check out some of the other benefits that make Personio a great place to work:

Receive a competitive reward package – reevaluated each year – that includes salary, benefits, and pre-IPO equity

Enjoy 28 days of paid vacation, plus an additional day after 2 and 4 years

Make an impact on the environment and society with 1 (fully paid) Impact Day

Receive generous family leave, child support, mental health support (including 24 sessions per year with Oli for yourself and 10 sessions for a significant other), and sabbatical opportunities

We enjoy gathering for meals, cultural initiatives, and events like local Summer Sessions and year-end celebrations. There's also healthy snacks, drinks, and a weekly catered lunch.