OverviewAs part of the CSOC, you will elevate global threat detection, investigation, and incident response through strategic leadership and AI-driven innovation.

You will shape TDR strategy, drive automation, and collaborate with cross-functional teams to strengthen cyber resilience.

This role blends deep technical expertise with a focus on measurable security impact at scale.

Join a mission-driven team advancing cybersecurity across Novartis' integral IT ecosystem.

Compensaciones / Beneficiosflexible and hybrid working options minimum 14 weeks paid parental leave insurance plans retirement plans wellbeing resources global recognition programs

ResponsabilidadesShape and influence global TDR strategy and drive operational excellence

Serve as senior technical authority for complex security challenges and incident response

Drive AI adoption, automation, and emerging technologies for detection/response

Lead initiatives with global leadership, engineering, and key stakeholders

Oversee security monitoring, threat detection, and triage across IT ecosystem

Leverage SIEM, analytics, and threat intel to enhance detection coverage

Improve detection engineering, controls, and capabilities against evolving TTPs

Escalate and lead complex security investigations and containment efforts





Translate findings into actionable recommendations to bolster cyber resilience

Drive continuous improvement of TDR processes, playbooks, and methodologies

Collaborate with engineering to advance SOAR and technology integration

Provide technical mentorship and promote best practices across global TDR teams

Requisitos principales8+ years in cybersecurity with 5+ years in Security Operations, Threat Detection, Incident Response, and Threat Hunting

Proven leadership of complex security investigations in large enterprises without direct people management

Track record of enhancing detection capabilities, incident response, and investigation quality

Mentoring security analysts and influencing stakeholders across teams

Hands-on expertise with SIEM, EDR/XDR, Detection Engineering, Security Telemetry, and IR tools (Microsoft Sentinel, Defender, Splunk)

Cloud security investigations across Azure and/or AWS (identity, endpoint, cloud telemetry)

Knowledge of MITRE ATT&CK;, threat intel, attacker behavior analysis

Security automation, SOAR, KQL/SPL/Python scripting, AI-enabled SOC use cases

Bachelor's degree (or equivalent experience)

Leadership

Stakeholder management

Communication

SIEM (Microsoft Sentinel)

EDR/XDR (Microsoft Defender, Splunk)

Detection engineering

📌 Associate Director Ddit Isc Detection & Response (Barcelona)
🏢 Novartis
📍 Barcelona