Senior Security Engineer (Defence) - Prague, Czechia
Outreach
Your Daily Adventures Will Include
- Incident Response: Triage, scope, contain, and eradicate across cloud, SaaS, identity, and endpoint; maintain runbooks, evidence, and concise stakeholder updates
- Threat Hunting: Hypothesis/ATT&CK-driven hunts; baseline behavior; author/tune detections (e.g. Zeek, YARA, etc.); automate workflows (Python/PowerShell/SOAR)
- Threat Intelligence: Transform IOCs/TTPs into hunts & detections; track actors/campaigns, produce short intel notes, and drive requirements; curate indicators in Malware Information Sharing Platform & Threat Sharing/OpenCTI where applicable
- Partner with platform/IAM on hardening (logging/retention, least privilege, secrets/key lifecycle)
- Contribute post-incident improvements and metrics.
Our Vision Of You
- 3–6+ years in IR/CSIRT with hands-on threat intel and threat hunting experience. Deep OS knowledge: Windows, macOS, Linux internals/artifacts and endpoint telemetry
- Understanding of networks & firewalls: TCP/IP, UDP, ICMP, HTTP/S, SMTP, DNS; packet/flow analysis; firewall/WAF/proxy rule review. SaaS security: Okta/Entra ID/Google Workspace, Salesforce, Slack, GitHub (audit, auth, OAuth investigations)
- Cloud IR: AWS/Azure/GCP audit sources and identity/OAuth pivots
- Tooling: EDR (CrowdStrike/SentinelOne/Defender), SIEM (Splunk/Elastic/Chronicle)
- Detection & Automation: Zeek/YARA/SQL; Bash/Python/PowerShell
- Understanding in container and exposure to Kubernetes and Docker.
- Proven experience in HIPAA and SOC 2 Type II environments.
- Excellent English
- Interpersonal skills: clear, structured communicator for technical and executive audiences. Calm, decisive leadership under pressure; ownership and follow-through. Customer-minded; explains risk/trade-offs and shares knowledge
Preferred Qualifications
- While not mandatory, the following qualifications will significantly differentiate strong candidates and indicate a deeper specialization:
- Experience with Security Orchestration, Automation, and Response (SOAR) platforms and playbook development
- Knowledge of malware analysis (static and dynamic) and reverse engineering techniques, and familiarity with associated tools
- Familiarity with DevSecOps principles and experience securing CI/CD pipelines
- Understanding of compliance frameworks relevant to SaaS environments (e.g., SOC 2, ISO 27001/27701/42001, GDPR, HIPAA)