Information Security - Senior Threat Detection & Response Engineer

• Full-time

About the Position

Ryanair Labs, the technology brand of Ryanair, is currently recruiting for two Information Security - Senior Threat Detection & Response Engineers to join Europe’s Largest Airline Group!

This is a very exciting time to join Ryanair as we look to expand our operation to 800 aircraft and 300 million guests within the next 10 years.

Ryanair Labs is a state-of-the-art digital & IT innovation hub creating Europe's Leading Travel Experience for our customers.

Responsibilities

• Proactively identify blind spots, missing telemetry, detections, and weak controls across on-prem, endpoint, and multicloud (AWS, GCP, Azure) environments.
• Participate in incident response, using findings from real incidents to build and test fixes.
• Map current telemetry and detections against MITRE ATT&CK, run adversary emulation and breach-and-attack-simulation tests, and audit log-source health and asset coverage.
• Convert each gap into a written item, prioritize into a backlog, and implement fixes.
• Own detection and visibility across AWS, GCP, and Azure control planes and identity.
• Run purple-team exercises and convert findings into detections and mitigations.
• Proactively hunt for uncovered techniques.
• Lead containment, eradication, and recovery during incidents, and perform forensic analysis.
• Automate enrichment, triage, and response using SOAR, Python, and PowerShell.
• Use LLM assistants and agentic coding tools to speed up rule authoring, backend conversion, test-case generation, parser/automation code, and triage.
• Produce coverage and performance metrics for leadership.

Requirements

• Must have

  • 6+ years hands-on in detection engineering, senior SOC analyst, or incident response.
  • Deep hands-on SIEM skills: Microsoft Sentinel, Splunk, Elastic (ELK), or OpenSearch, including their query languages (KQL, SPL, ES|QL/Lucene).
  • Hands-on EDR: Microsoft Defender, SentinelOne, or CrowdStrike, including their hunting query interfaces and custom detection rules.
  • Sigma, including converting and testing rules against each backend.
  • Multicloud security across AWS, GCP, and Azure: audit and security telemetry, IAM and identity attack paths, and cloud-specific detection use cases.
  • Proven track record of finding and closing detection or visibility gaps, with examples of your methodology.
  • Practical MITRE ATT&CK use for coverage assessment, not just tagging.
  • Adversary emulation / breach-and-attack-simulation experience.
  • Strong Python or PowerShell; comfortable with Git and CI for detection-as-code.
  • Effective daily use of LLM assistants and agentic coding tools for detection-as-code, automation, and analysis, with critical validation of output and within approved data-handling boundaries.
  • Clear communication under incident pressure.

• Nice to have

  • Aviation, logistics, or other regulated-sector experience; NIS2 / EASA Part-IS.
  • SOAR platform experience.
  • Elastic Security detection rules and OpenSearch Security Analytics (Sigma-native).
  • Container/Kubernetes telemetry (EKS, GKE, AKS) and CSPM/CNAPP tooling.
  • Certifications: GDAT, GCIH, GCFA, GCIA, AZ-500, AWS Security Specialty, Google Professional Cloud Security Engineer.
  • Threat modelling / adversary profiling; exposure-management or attack-path tooling.
  • AI security: MITRE ATLAS, OWASP Top 10 for LLM Applications; agentic security automation with LLM agents.

We Offer

• A competitive but flexible technical career plan.
• Possibility for career growth in a continuously growing team.
• Hybrid working model: up to three days per week remote, with excellent work environment at our modern offices in the heart of Madrid.
• Optional discounts on health insurances (various companies).
• Travel discounts.

About the Company

Ryanair Labs is the technology brand of Ryanair. Labs is a state-of-the-art digital & IT innovation hub creating Europe's Leading Travel Experience for our customers.

Job Location

Madrid, Spain