Security Incident Detection & Response Expert (m/w/d)

About the Position

Security Incident Detection & Response Expert (m/w/d)

Informationstechnik (IT)

Jetzt bewerben

---

About the Company

kubus IT, with over 700 employees, ensures IT operations for 17,000 AOK users in Bavaria, Saxony, and Thuringia. Our services range from complete technical system operations to application support, consulting, and development. Our core values are secure, flexible, and innovative, and we individually address our clients' needs.

For inquiries, please contact the responsible HR manager, Mr. Maik Horn, Tel: 01743176714, Mail: [email protected].

---

About the Position

We are seeking a Security Incident Detection & Response Expert to join our team in Bavaria, Germany, specializing in advanced threat detection and response.

---

Responsibilities

• As a Security Incident Detection & Response Expert at kubus IT, you will take on a deep technical expert role in the Cyber Defense Center (CDC) and support CDC staff as a central 3rd-level contact for complex issues related to security incident detection and response.
• You will analyze sophisticated security incidents, attack patterns, and anomalies in complex IT environments and assist Security Incident Analysts in evaluating, prioritizing, and technically classifying security-relevant events.
• You will create technical guidelines, designs, and decision templates for detection and response scenarios, translating current threat situations into specific requirements for use cases, detection rules, playbooks, and technical safeguards.
• You will conduct active threat hunting to help improve existing detections and proactively identify threats.
• You will develop existing detection use cases, assess their effectiveness and quality, and support the optimization of detection in modern security technologies such as SIEM, EDR, SOAR, and cloud security solutions.
• You will identify improvement potentials in the security incident detection and response processes and actively drive the development of comprehensive security incident management.
• You will actively share your expertise with CDC staff, support technical quality assurance, and contribute to the continuous improvement of operational detection and response capabilities through reviews, guidelines, and technical recommendations.
• You will serve as a mentor and coach for new or less experienced staff, helping to develop an effective security incident management team.

---

Requirements

• You hold a completed university degree in computer science or equivalent qualifications (e.g., BA degree in IT, advanced training certificate) combined with several years of professional experience.

• You speak German very well (at least C1 level).

• You have solid experience with security technologies such as SIEM, E/XDR, SOAR, threat intelligence platforms, or cloud security solutions.

• You are familiar with common attack and defense frameworks, particularly MITRE ATT&CK and D3FEND, and can derive practical detection and response requirements from them.

• You possess in-depth knowledge in all and advanced knowledge in at least 2 of the following domains:

  • Operating systems and system-near technologies (Windows and Linux)
  • Digital forensics and evidence preservation, especially in coordinating external forensic service providers and understanding expert opinions
  • Network and protocols, particularly network-based attack methods
  • Penetration testing (mobile, app, or web)
  • Detection, analysis, and handling of (complex) security incidents
  • Cyber threat intelligence (CTI) and threat-based detection rules
  • Threat hunting
  • Common regulatory standards and guidelines (e.g., NIS2, ISO27001, NIST CSF, BSI Grundschutz, IT-SiG)

• You are communicative and continuously develop yourself independently.

• You think and act analytically, work independently, and are responsible.

• You reliably meet deadlines and occasionally take call duties.

• You have a driver's license and are willing to undertake multi-day business trips.

---

We Offer

• Indefinite employment contract with a large, reputable statutory health insurance provider (AOK Bayern or AOK PLUS, depending on location)
• Flexible working hours with a time account - no core working hours.
• Work possible at all kubus IT locations (Saxony, Thuringia, and Bavaria)
• Possibility of mobile work (home office, near AOK locations) up to 3 to 4 days a week
• Remuneration according to the Federal Employees' Tariff Agreement AOK/Neu (starting salary depending on relevant professional experience with pay grade 10 from approx. 71,000 Euro gross/year, advancement to pay grade 11 after familiarization from approx. 79,000 Euro gross/year).
• Additional social surcharges for married couples and parents
• 30 days of vacation + December 24th & December 31st off.
• Christmas bonuses (13th salary).
• Employer's contribution to health promotion.
• Company pension scheme.
• Provision of a company laptop and smartphone
• Discounted Germany Job Ticket.
• Corporate benefits (employee discounts).
• Numerous further training opportunities within working hours

Disabled applicants will be given preference if they are equally qualified.

---

How to Apply

We look forward to receiving your application by December 6, 2026.

---

Working at AOK Means...

"Many further training and continuing education offers help with advancement and facilitate career progression. A real advantage: AOK covers the costs."

Gerhard Kruppenbacher

Personnel Marketing/Recruitment of AOK Rheinland-Pfalz/Saarland

---