About this role
About the Role EY GDS Spain is seeking a Cyber Security SOC Manager (German Speaker) with expertise in Microsoft XDR solutions. This role focuses on architecting and implementing cloud security monitoring using MS Sentinel and Defender XDR, developing and testing use cases, and leading customer engagement from testing to production within the solution studio environment. What You'll Do
- Architect and implement cloud security monitoring platforms using Microsoft Sentinel and Defender XDR.
- Research, develop, and implement use cases in Sentinel/Defender XDR within the solution studio and manage the studio.
- Provide consulting to customers during testing, evaluation, pilot, production, and training phases to ensure successful deployment.
- Serve as the subject matter expert on Cloud Security solutions and apply the capabilities in daily operational work for the end customer.
- Secure overall cloud environments by applying cybersecurity tools and best practices.
- Advise customers on best practices and use cases to meet end-state requirements.
- Develop content and processes for automated security event monitoring and alerting with incident response plans.
- Develop migration plans from Splunk/QRadar/LogRhythm to MS Sentinel.
- Deep understanding of Azure best practices for designing and securing the platform.
- Advise on Microsoft Cloud Security capabilities across Azure.
- Configure data ingestion types and connectors; design analytic configurations for events and logs.
- Develop, automate, and orchestrate tasks (playbooks) with Logic Apps based on events.
- Configure Sentinel Incidents, Workbooks, Hunt Queries, and Notebooks.
- Work with other cloud-native security platforms (AWS, GCP) is a plus.
- Scripting in Python, Bash, PowerShell.
- Knowledge of security threats, security monitoring, and cyber incident response.
- German language proficiency (C1 or above). What We're Looking For
- B.Tech/B.E. with strong technical skills; excellent verbal and written English; German language proficiency (C1).
- Azure certification (and other cloud vendor certifications are a plus).
- Experience with MS Sentinel/Defender XDR; migration experience (Splunk/QRadar/LogRhythm to MS Sentinel).
- Deep understanding of designing and securing the Azure platform and cloud security best practices.
- Experience with threat modelling, MITRE ATT&CK, Cyber Kill Chain.
- Experience integrating devices/applications including in-house built with custom parsers.
- Scripting knowledge (Python, Bash, PowerShell).
- Strong interpersonal and presentation skills; capable of consulting across testing, pilot, production, and training phases.
- Ideally, people/project management skills. Nice to Have
- Experience with other cloud-native security platforms (AWS and GCP) is a plus. Compensation & Benefits
- Empowering Career Development: tailored training and development programs.
- Flexible Work-Life Integration: hybrid work model.
- Comprehensive Well-Being Programs: wellness initiatives and psychological support.
- Meaningful Volunteering Opportunities: community engagement.
- Recognized Performance and Rewards: programs for individual and team achievements.