Information Security – Senior Threat Detection & Response Engineer

About the Position

Ryanair Labs is currently recruiting for Information Security – Senior Threat Detection & Response Engineers to join Europe’s Largest Airline Group!

This is a very exciting time to join Ryanair as we look to expand our operation to 800 aircraft and 300 million guests within the next 10 years.

Ryanair Labs is the technology brand of Ryanair. Labs is a state of-the-art digital & IT innovation hub creating Europe's Leading Travel Experience for our customers.

Responsibilities

• Find: Map current telemetry and detections against MITRE ATT&CK, run adversary emulation and breach-and-attack-simulation tests, mine incidents, hunts, pentests, and threat intel for techniques we couldn't see or stop, audit log-source health and asset coverage.
• Define: Turn each gap into a written item: technique, affected assets, risk, required telemetry, detection logic, mitigation, owner, and acceptance test. Prioritize into a single backlog against the threats most relevant to aviation.
• Fix: Onboard and normalize log sources; build detections as code (Sigma as the source of truth, converted to KQL, SPL, or Elastic/OpenSearch queries; version-controlled and tested in CI); tune to an agreed false-positive budget; work with platform owners to implement and verify preventive controls (hardening, EDR policy, identity and conditional access, cloud guardrails); re-test to prove closure; update the coverage map.

Requirements

Must Have

• 6+ years hands-on in detection engineering, senior SOC analyst, or incident response.
• Deep hands-on SIEM skills: Microsoft Sentinel, Splunk, Elastic (ELK), or OpenSearch, including their query languages (KQL, SPL, ES|QL/Lucene).
• Hands-on EDR: Microsoft Defender, SentinelOne, or CrowdStrike, including their hunting query interfaces and custom detection rules.
• Sigma, including converting and testing rules against each backend.
• Multicloud security across AWS, GCP, and Azure: audit and security telemetry (CloudTrail/GuardDuty, Cloud Audit Logs/Security Command Center, Azure Activity + Entra ID logs/Defender for Cloud), IAM and identity attack paths, and cloud-specific detection use cases.
• Proven track record of finding and closing detection or visibility gaps, with examples of your methodology.
• Practical MITRE ATT&CK use for coverage assessment, not just tagging.
• Adversary emulation / breach-and-attack-simulation experience.
• Strong Python or PowerShell; comfortable with Git and CI for detection-as-code.
• Effective daily use of LLM assistants and agentic coding tools (e.g., Claude Code, OpenCode) for detection-as-code, automation, and analysis, with critical validation of output and within approved data-handling boundaries.
• Clear communication under incident pressure.

Nice to Have

• Aviation, logistics, or other regulated-sector experience; NIS2 / EASA Part-IS.
• SOAR platform experience.
• Elastic Security detection rules and OpenSearch Security Analytics (Sigma-native).
• Container/Kubernetes telemetry (EKS, GKE, AKS) and CSPM/CNAPP tooling.
• Certifications: GDAT, GCIH, GCFA, GCIA, AZ-500, AWS Security Specialty, Google Professional Cloud Security Engineer.
• Threat modelling / adversary profiling; exposure-management or attack-path tooling.
• AI security: MITRE ATLAS, OWASP Top 10 for LLM Applications; agentic security automation with LLM agents.

We Offer

Contract of employment (permanent contract after trial period)

• Staff travel benefits from day one
• Multisport card
• Private health care
• Group insurance scheme

Other benefits:

• Possibility of taking part in trainings and certifications
• Great chance to meet your colleagues in other offices
• Annual events (i.e. St. Patrick’s Day 🍀)
• Regular social meetings 🍻
• Paid referral system
• New office building surrounded by great dinettes right in the city centre 🌆

About the Company

Ryanair Labs is the technology brand of Ryanair. Labs is a state of-the-art digital & IT innovation hub creating Europe's Leading Travel Experience for our customers.