Defensive Security Engineer

As the Defensive Security Engineer, you will be part of the company’s Incident Response (IR) team and collaborate with our Security Operations Centre (SOC) provider. This role is crucial in defending our digital assets, ensuring an effective response to security incidents, and proactively enhancing our defensive posture. This position requires autonomy and pro‑activeness skills, and a deep understanding of defensive cybersecurity technologies. You will be instrumental in ensuring that Adevinta’s security strategy covers industry‑relevant security standards. The Incident Response team is part of the Information Security department where your team will collaborate with other services such as Vulnerability Management, Bug Bounty programs, and SPLC Security among others. What you will do: Contribute to the Incident Response (IR) team’s efforts by fostering a culture of proactive defence and continuous improvement through active participation in response processes and initiatives. Actively participate in the incident response lifecycle, including preparation, detection, analysis, containment, eradication, recovery and learning, ensuring timely and effective responses to potential threats. Support the development and refinement of incident response policies, playbooks, escalation procedures, and tabletop exercises. Additionally, you will contribute to post‑mortem analyses to improve incident detection and response capabilities continuously. Work closely with other relevant teams and roles, such as the DPO, Privacy, Global Incident Teams, the rest of the InfoSec teams, and E&C, ensuring effective communication and alignment during incident response efforts. Assist in managing the external MSSP by ensuring alignment with organisational policies, standards, and expectations regarding service quality. You will collaborate with the SOC team to monitor and assess the performance of security monitoring, triage, and alerting processes, contributing to optimising SOC operations and improving efficiency. Participate in the operations and enhance the control of defensive security technologies, including EDR, SIEM, DLP, NIDS, and threat intelligence solutions. Gather, analyse, and operationalise threat intelligence information to enhance detection, response, and prevention efforts, ensuring timely identification and mitigation of potential threats. Collaborate to prepare periodic reports and collaborate with cross‑functional teams to share valuable insights gained from alerts and incidents. This collaboration will help drive enhancements to security controls and inform product decisions to reduce the frequency and impact of future incidents. You will report to the Incident Response Manager. You may be required to travel occasionally, mainly to the EU. You will have the possibility of being on‑call. Who you are: An experienced security analyst with the mentioned solutions and resolving security incidents in large enterprise environments. You are familiar with Incident Management At Google (IMAG). Structured, analytical, autonomous and proactive persona. Familiar with the Agile methodology. 1 year‑experience with security frameworks and methodologies such as MITRE ATT&CK, ENISA or NIST. You have a hacker and an open mindset. You have software development skills. You have a good understanding of AWS Cloud technologies, services, security capabilities, and controls such as SCPs, Security Groups, IAM, etc. You understand SDLC (coding and development) with modern tooling and ecosystems such as Kubernetes, Github, Github Actions, infrastructure as code, etc. You have excellent knowledge of security for networks, protocols, systems and applications. You have strong analytical and problem‑solving skills, with the ability to synthesise complex data into actionable insights. You are fluent in English (spoken and written). You have excellent communication and interpersonal skills, with the ability to build relationships and influence others. You have demonstrated an ability to work in a multicultural environment. Nice to have: Public or private presentations. Open source contributor. Participated in conferences and training. Certifications. Member of bug bounty programs, CTF player or member of ethical hacking communities, recognised in the Hall of Fame, CVE mentions or vulnerability reporter. #J-18808-Ljbffr