As an IT Security Analyst, you will be part of a central IT Security team. You will play an active role in protecting our critical IT and cloud environments against cyber threats.

A key aspect of this role is participation in the IT Security on-call service:

• On-call duty according to a rotation schedule of approximately one week every 3 to 4 weeks
• The on-call period runs from Monday morning to Monday morning (7 consecutive days)
• During this period, you may be called upon to handle, among other things, Priority 1 security incidents
• You act as the first point of contact for serious security events and handle them autonomously
• You are able to independently analyze, make decisions, and take action
• You will work closely with IT Operations, Architecture, the CISO Office, and external partners

1. Cybersecurity Analysis & Detection

• Analyze alerts, anomalies, and suspicious activities
• Develop defense strategies based on Secure by Design and Zero Trust principles
• Prepare security risk and threat reporting for both technical and management stakeholders
• Implement and monitor preventive security controls
• Apply information security standards (e.g., ISO, NIST, CIS)

2. Incident Management & Crisis Management

• Develop, maintain, and test incident response playbooks
• Actively manage security incidents
• Report on incidents (both technical and non-technical)
• Coordinate security crises and escalations
• Perform or coordinate:
  • Containment and eradication activities
  • Forensic investigations
  • Post-incident root cause analyses
• Collaborate with internal and external parties (SOC, vendors, auditors, CERTs, etc.)
• Support and follow up on penetration testing and vulnerability management activities

3. Knowledge Management & Continuous Improvement

• Actively contribute to knowledge sharing and documentation within the security team
• Perform threat hunting based on real-world threats and relevant intelligence
• Participate in or support red team / blue team activities
• Continuously improve:
  • Detection systems
  • Incident management processes
  • Reporting and metrics

4. Security Risk Assessment

• Conduct security maturity assessments (technical and organizational)
• Develop and maintain technical security roadmaps
• Support risk-based decision-making towards IT Architecture and management
• Identify and assess risks using structured methodologies (e.g., STRIDE)
• Translate technical risks into understandable business impact for non-technical stakeholders

5. Microsoft Security Tooling

Daily use and optimization of Microsoft security platforms, including:

• Microsoft Defender (Endpoint, Identity, Cloud, CASB, DLP, etc.)
• Azure security controls
• Integration of logs, alerts, and response workflows
• Automation wherever possible (playbooks, use cases, response workflows)