Senior Security Engineer (SOC) (m,f,x)

About the role

<h2><strong>The role</strong></h2> <p>We’re looking for a new teammate to join us on the journey of keeping HelloFresh a trusted name - someone with a passion for security and appetite for new challenges. Security Engineers work in a variety of ways to constantly iterate and improve HelloFresh’s security posture.&nbsp;</p> <p>As an Experienced SOC Analyst at HelloFresh, you’ll bring advanced expertise to our SOC team in Manila. Working in a flat team structure, you’ll act as a Senior Engineer handling escalations from junior analysts, driving complex investigations, and ensuring accurate incident reporting.</p> <p>You’ll be the point of contact for Berlin SOC leadership during major incidents, mentor junior colleagues, and help refine SOC processes. This is a hands-on technical role with strong responsibility, requiring both depth in incident response and leadership qualities to keep the operations effective</p> <p>Above all, we are looking for people who will&nbsp;<strong>make HelloFresh</strong>&nbsp;<strong>better.</strong>&nbsp;We believe there are many different ways of developing skills and we love diverse experiences! So even if you don’t “tick all the boxes” but think you’d thrive in this role, we would really like to learn more about you.</p> <h2><strong>What you’ll do</strong></h2> <ul> <li> <ul> <li><strong>Responsible </strong>for maturing logging and monitoring of Cloud, IT and Application workloads through automation and IaC</li> <li><strong>Filter, ingest and optimize </strong>security-specific events from large log streams such as App logs, Kubernetes logs, CloudTrail, CloudFlare and ELB logs etc.</li> <li><strong>Conduct</strong> threat hunts against file-less malware and APTs by leveraging EDR, OS and network telemetry acquired through specialized open-source tool set like Sysmon, Osquery, RITA and Zeek</li> <li><strong>AI-Enhanced Coding:</strong> Ability to use AI coding assistants to write scripts for security automation and data parsing and building detection logic.</li> <li><strong>Investigation Acceleration:</strong> Proficiency in using LLMs (e.g., Claude, ChatGPT, Gemini) to quickly summarize high-volume JSON logs, investigate and explain complex code snippets etc.&nbsp;</li> <li><strong>Develop </strong>advanced correlation and cross-correlation rules beyond what is available out of the box to detect sophisticated attacks and fraud cases</li> <li><strong>Generate </strong>security metrics and reporting on incidents and effectiveness of the SOC operation</li> <li><strong>Lead</strong> efficient Incident Detection and Response in AWS cloud and enterprise IT environments</li> <li><strong>Shift Communication: </strong>Serve as the shift’s main communicator, updating Berlin SOC leadership and local IT/business stakeholders during active incidents.</li> <li><strong>Playbook &amp; Process Improvement:</strong> Suggest detection rule tuning, SOP refinements, and contribute to the team knowledge base to reduce false positives and improve workflows.</li> </ul> <ul> <li><strong>Mentor</strong> level (L1) SOC team, conduct purple teaming workshops and participate in CTFs</li> </ul> </li> </ul> <h2><strong>What you’ll bring</strong></h2> <ul> <li>Proven security monitoring and incident response experience in public cloud environments</li> <li>Experience with cloud SIEM &amp; SOAR platforms, DDoS mitigation and preventing tools and Layer-7 Web-based perimeter security controls</li> <li>Excellent programming (automation) skill with Python / Go</li> <li>Experience with cloud SIEM &amp; SOAR platforms, DDoS mitigation and preventing tools and Layer-7 Web-based perimeter security controls</li> <li><strong>AI-Enhanced Coding:</strong> Ability to use AI coding assistants to write and debug Python scripts for security automation and data parsing.</li> <li><strong>Detection Logic:</strong> Proficiency in writing detection rules (Sigma, KQL) with the assistance of AI tools to optimize query performance and coverage.</li> <

Skills