Cybersecurity Platform Engineer (MCO Detection and Response Capabilities)

Project overview

Job Title: Cybersecurity Platform Engineer (MCO Detection and Response Capabilities)

Reference: 26-04-6613-002

Responsibilities

Education:

Core Skills:

Important Skills:

• Ensure the permanent operation of the data, tools, and technical chains necessary to respond to attacks and incidents.
• Ensure the availability, reliability, performance, security, and operational effectiveness of the technical capabilities used by the cybersecurity team.
• Be the technical point of reference for security platforms and processing chains that transform technical data into operational detection and response capabilities.
• Automate deployments and configuration checks, and implement pre-production testing procedures.
• Manage the lifecycle and obsolescence of components.
• Identify technical anomalies that could degrade detection capabilities: telemetry loss or delay, parsing errors, saturation, connector failure, rule or integration malfunction.
• Plan, test, and deploy software updates and security patches for tools (detection signatures, SIEM rules, etc.).
• Keep technical documentation up-to-date (configurations, procedures, architecture diagrams).
• Monitor detection tools (SIEM, EDR, etc.) and their integrations to anticipate failures or degradations.
• Analyze root causes (RCA) of failures to prevent recurrence.
• Produce regular reports on the status of tools (availability, performance, incidents).
• Present key metrics (mean time to resolution, number of false positives, etc.).
• University Master's degree in Computer Science, EPF Engineering degree, or equivalent.
• Proven experience in the administration and production operation of complex cybersecurity / SOC platforms.
• In-depth experience in the administration and operation of at least one major SIEM platform and a good understanding of SIEM, EDR/XDR, SOAR, and log collection architectures.
• Operational mastery of Splunk and SPL.
• Ability to build technical dashboards and indicators for availability, performance, and service quality.
• Mastery of security event collection and processing architectures: agents, collectors, APIs, Syslog, parsing, normalization, enrichment, routing, ingestion, and storage.
• Ability to diagnose telemetry losses, delays, duplications, or anomalies and ensure the completeness and quality of data used by the SOC.
• Ability to automate operational, control, and deployment tasks using a scripting language.
• Knowledge of high-availability architectures, backup and restore mechanisms, and application continuity and recovery principles for security platforms.
• Ability to monitor capacity, performance, volume, and technical thresholds of platforms.
• Practice with Git or an equivalent version control mechanism.
• Knowledge of detection technologies and mechanisms: correlation, analytics, UEBA, behavioral detection.
• Knowledge of Microsoft Azure, Entra ID, and M365 is an asset.

Nice to have

Required Qualities:

• PowerShell scripting.
• Python scripting.
• Rigor and analytical thinking.
• Ability to quickly make a technical diagnosis.
• Structured problem diagnosis and resolution skills.
• Enjoyment of automation and continuous improvement.
• Service-oriented and sense of operational responsibility.
• Ability to document and communicate with technical and operational teams.

Project details

Geneva

Desired Start Date: 01.01.2027

100%

Remuneration: from 149,000 CHF / year

Job Description and Context:

We are looking for a cybersecurity platform engineer for a client, a public administration in Geneva, to strengthen its operational cybersecurity capabilities.

The successful candidate will ensure the availability, reliability, performance, and effectiveness of the tools and technical chains used by the cybersecurity team to detect, analyze, and respond to incidents (SIEM, EDR, SOAR, log collection). As the technical point of contact for these platforms, they will ensure their operational maintenance and evolution, without replacing the analysts responsible for incident investigation. Long-term mission (up to 5 years).

• Start: flexible
• Location: Geneva, Geneva, CH
• Languages: French