Security Engineer, Advanced Investigation and Incident Response

Project overview

Job Title: Security Engineer, Advanced Investigation and Incident Response

Reference: 26-04-6613-001

Responsibilities

Education:

Primary Skills:

Important Skills:

• Contribute to the continuous improvement of the detection, response, and investigation capabilities of the SOC and the internal team.
• Detect, analyze, investigate, and contribute to the handling of cybersecurity events and incidents, by leveraging EDR alerts and other available security data sources.
• Analyze detection coverage and propose, develop, and adjust detection rules or use cases based on observed incidents, attack techniques, and the MITRE ATT&CK framework.
• Evaluate the quality of telemetry and security data necessary for an investigation and identify visibility gaps.
• Qualify incidents, define their scope, ensure containment and collection of technical evidence, assist with eradication and recovery, and capitalize on lessons learned.
• Coordinate technical aspects and investigations with the external SOC and the infrastructure, network, systems, applications, and IAM teams.
• Transform a technical alert into an understanding of the security situation: determine what happened, on which system, with which account or identity, by which vector, what actions were performed, and what other systems might be affected.
• Determine whether the event constitutes a security incident and what containment or remediation measures are necessary.
• Propose, create, and adjust detection rules to reduce false positive and false negative rates.
• University Master's degree in Computer Science, EPF Engineering Diploma, or equivalent.
• Proven professional experience in a SOC, CSIRT, or incident response team, with practical experience in complex security investigations.
• Excellent knowledge of SOC operating principles.
• In-depth operational use of an EDR/XDR for investigation (process tree analysis, endpoint investigation, etc.), threat hunting, trace collection, and response actions.
• Practical experience with a SIEM and proficiency in a query language for conducting investigations on large volumes of logs (SPL or equivalent).
• Proficiency in log analysis.
• Good knowledge of attacker techniques and tactics and the ability to analyze them through MITRE ATT&CK.
• Proficiency in IoC, IoA, and TTP-based threat hunting.
• Ability to conduct security investigations.
• Knowledge of common attack techniques.
• Knowledge of persistence and lateral movement mechanisms.
• Excellent understanding of Windows and Linux systems.
• Knowledge of TCP/IP, DNS, HTTP(S), proxy, firewall, and VPN.
• Knowledge of Active Directory.
• Understanding of authentication mechanisms (Kerberos, NTLM, OAuth2, OIDC, SAML).
• Ability to investigate identity compromises: compromised accounts, privilege escalation, credential theft, lateral movement, and abuse of authentication mechanisms.
• Experience in Threat Hunting.
• Knowledge of cloud environments (Entra ID, M365, Azure).

Nice to have

Required Qualities:

• Knowledge of SOAR mechanisms.
• PowerShell scripting.
• Python scripting.
• Knowledge of forensic tools.
• Analytical mindset and ability to investigate methodically.
• Curiosity and interest in technical research.
• Rigor and quality of documentation.
• Ability to communicate and work with multidisciplinary teams.
• Autonomy and ability to work under pressure during incidents.

Project details

Geneva

Desired Start Date: 01.01.2027

100%

Compensation: from 149,000 CHF / year

Job Description and Context:

We are looking for a security engineer specializing in advanced investigation and incident response for a client, a public administration in Geneva, to strengthen its operational cybersecurity capabilities.

The successful candidate will be dedicated to monitoring security events, investigating alerts (especially EDR) and qualifying incidents, as well as researching and analyzing traces of a compromise and responding to eradicate it. They will work in close interaction with the external SOC and the operational security, infrastructure, network, systems, applications, and IAM teams. Long-term mission (up to 5 years).

• Start: flexible
• Location: Geneva, Geneva, CH
• Languages: French