This position is at T-Systems

The selection process will be entirely managed by T-Systems.

--

Job Description T-Systems, a leading multinational in Information and Communication Technologies, needs to hire a Cybersecurity Automation Engineer in Madrid, Barcelona or Granada. You will belong to the T-Systems Cybersecurity area, which brings together ITSecurity, Network Security and Cybersecurity SOC services. Specifically, it will be part of the T-Systems SOC. Its main function will be to support the automation of SOC operations that are being carried out in the area through the use and integration of multiple tools that support SOC processes. To this end, as a cybersecurity engineer at the SOC, you will carry out tasks related to the implementation and maintenance of SIEM/SOAR platforms to analyze security events, configure alerts for proactive threat detection and collaborate in the adaptation of configurations. You'll use SOAR tools to automate incident responses, improving efficiency and effectiveness in cybersecurity operations. A deep understanding of cybersecurity principles and SIEM/SOAR systems is crucial for implementing effective automated solutions and improving defense against cyber threats. Your main functions will be the following:

- Perform SIEM configurations and use cases: Develop and implement complex configurations within the SIEM system to ensure optimal detection and response capabilities, including correlation rules, filters, and data source integrations.
- Development of automations and playbooks in the SOAR: Develop custom scripts or automation workflows to improve the automation capabilities of the SOAR platform,



allowing for more efficient incident response and mitigation.
- Integration of SOC tools through APIs to automate and improve the efficiency and effectiveness of SOC processes.
- Scripting and programming development: scripting in languages such as Python, PowerShell or Bash to develop custom scripts for automation, integration and data manipulation.
- Optimization: Continuously adjusting and optimizing the SIEM/SOAR modules to improve their effectiveness over time, adapting to changes in the threat landscape and organizational needs.
- Collaboration with SOC teams, Cybersecurity Architecture, CuSM, and other IT teams: You'll work closely with IT and other security teams to understand the organization's infrastructure, applications, and network architecture, ensuring effective SIEM/SOAR integration.

Requirements Languages: Spanish, Middle English, valuable High English. University education in technical or higher IT or telecommunications engineering or other similar technical qualification. Highly valuable master's degree or specialization in cybersecurity or similar. Demonstrable experience of at least 3 years in the field of cybersecurity, at least 2 of them in a SOC or similar in functions similar to those of the position. Technical Knowledge Cybersecurity fundamentals and basic knowledge:

- Security Principles: Confidentiality,



Integrity and Availability (CIA).
- Types of Threats: Knowledge about malware, phishing, denial of service (DoS) attacks, APTs (Advanced Persistent Threats), TTPS (attack techniques and tactics), etc.
- Incident Analysis: Understanding the full lifecycle of incident management, from detection to remediation and post-incident reporting.
- Identification and Containment: Ability to quickly identify the nature of a security incident and take initial containment measures.
- Investigation: Ability to delve into the technical details of an incident, using logs, network traffic analysis, and forensic analysis tools.
- Cloud security: Familiarity with cloud computing environments (AWS, Azure, GCP) and experience in protecting cloud-based infrastructures and services.

Knowledge in Networks and Systems.

- Understanding network architecture and topologies.
- Knowledge of common protocols such as TCP/IP, HTTP, HTTPS, DNS, etc.
- Operating Systems: Familiarity with Windows, Linux and Unix operating systems.
- Event Log: Knowledge about event logging systems in different operating systems (for example, Event Viewer on Windows, syslog on Linux).

Knowledge and experience in SIEM (Security Information and Event Management)

- SIEM tools: Familiarity with SIEM tools. Very valuable knowledge and experience in SPLUNK SIEM and/or Azure Sentinel.
- Data Intake and Normalization: Understanding how record data is collected, normalized and stored.
- Rules and Event Correlation: Ability to create and adjust correlation rules to detect attack patterns and suspicious activities.
- Al

📌 Cybersecurity Automation Engineer SOC SIEM/SOAR (Madrid)
🏢 T-Systems
📍 Madrid