ABOUT US

At BASF Digital Hub Madrid we develop innovative digital solutions for BASF, create new exciting customer experiences and business growth, and drive efficiencies in processes, helping to strengthen BASF´s position as the digital leader in the chemical industry.

We believe the right path is through creativity, trial and error and great people working and learning together. Become part of our team and develop the future with us - in a general team that embraces diversity and equal opportunities. We are committed to fostering an inclusive workplace and strongly encourage applications from individuals with disabilities. We value diversity and believe that varied perspectives enhance our team's effectiveness. Our hiring practices are designed to ensure equal opportunity for all candidates.

As Principal Analyst, you are the most senior technical authority within the CSDC - a recognized subject matter expert who leads from expertise, not hierarchy. You shape the strategic direction of our detection and response capabilities, act as the technical bridge to adjacent security functions, and represent the CSDC in internal governance bodies and external communities.

RESPOSIBILITIES

- Lead the technical response to our most complex and high-risk security incidents as Case Lead - from triage and analysis through containment, eradication, resolution, and closure
- Lead investigations and compromise assessments
- Analyze complex malicious artifacts (binaries, scripts, documents) through static and dynamic analysis and reverse engineering to determine their underlying, often obfuscated, functionality
- Drive our hypothesis-driven threat hunting program: design hunting campaigns,



validate hypotheses against threat intelligence, and convert findings into durable detection coverage
- Design, review, and continuously improve detection logic, correlation rules, and SOAR playbooks on our Elastic Security platform, applying Detection-as-Code practices
- Shape the CSDC automation and AI roadmap: co-design AI-assisted triage and investigation workflows and supervise their operation with clear human-in-the-loop safeguards
- Define the strategic roadmap for detection and response capabilities together with CSDC leadership; evaluate and recommend new technologies, tools, and methodologies
- Act as technical advisor to CSDC leadership on capability development, and as senior escalation point and on-call resource for critical incidents
- Mentor and train Tier 2 and Tier 3 analysts; develop advanced training content and drive knowledge transfer across the team
- Lead cross-functional initiatives with adjacent teams (Cyber Threat Intelligence, Offensive Security, Vulnerability Management, Platform Engineering) and steer external service providers to meet BASF security requirements
- Represent the CSDC in internal security governance bodies and in external communities and trusted networks (e.g., BSI, Deutscher CERT-Verbund, CSSA, FIRST)

QUALIFICATIONS

Education and Experience

- Degree in computer science, IT security,



or a comparable technical qualification
- 8+ years of professional experience in cyber defense, incident response, with a track record as a recognized subject matter expert
- Demonstrated experience leading technical teams and investigations under pressure in high-stakes situations

Technical Expertise

- Expert-level knowledge of the internals of mainstream operating systems (Microsoft Windows, Linux) and of network protocols and traffic analysis
- Deep understanding of current attacker tradecraft: advanced persistent threats, actors, infrastructures, and TTPs, structured along MITRE ATT&CK;
- Strong hands-on expertise with Elastic Security as SIEM and EDR: detection rule development and tuning, investigation and hunting; experience with Elastic automation capabilities (workflows, AI Assistant) and ES|QL is a strong plus
- Proficiency with modern DFIR tooling (e.g., OSQuery, Velociraptor, Volatility, Suricata, Wireshark) and with malware analysis and reverse engineering tools (e.g., Ghidra, IDA Pro, x64dbg, WinDbg)
- Solid experience in cloud and identity threat detection and response (Microsoft Entra ID / Active Directory, Azure, AWS)
- Ability to program in Python and ideally Go; confident scripting in common shells (Bash, PowerShell); ability to read C and x86/x64 assembly in the context of reverse engineering
- Working understanding of AI/ML applications in security operations (model-assisted triage, LLM-assisted investigation, explainability) is a plus

Leadership and Communication

- Proven ability to lead technical experts through stressful situations and to remain a calm, structured

📌 Principal Analyst Cyber Security Defense Center (España)
🏢 Basf
📍 España