Information Security Engineer - Technical Incident Response & Detection SIEM/ EDR (m/f/d)

HPI is one of the leading university computer science institutes (www.hpi.de). Our goal is to the digital sovereignty of Europe with excellent research and practical teaching in the To strengthen computer science. At the HPI we are convinced that excellence is created when we know linking different disciplines in cooperation to jointly responsible and to design directional solutions for the future. In our research clusters ''Systems', ''Data and AI', ''Foundations'', ''Digital Health'', ''Security'' and ''Business and Society'', researchers from several disciplines are working together on questions that are to contribute to solving social challenges. The digital engineering faculty of University of Potsdam and the HPI offers a unique engineering science study in Germany.

The Hasso-Plattner Institute is looking for the closest possible growth Time at the Potsdam site

Information Security Engineer (m/w/d) - Technical Incident Response & Detection SIEM/ EDR

The body shall be permanent and full-time.

The Information Security department is responsible for building, developing and operating central information security processes at the HPI. Our aim is to support research, teaching and administration through effective, pragmatic and well- implementable security measures. As an information security engineer, you are part of the information security team and make sure that the HPI can react quickly, fact-based and controlled in cyber incidents. You work closely with IT, research, data protection and the CISO team. As an information security engineer, you are part of the information security team and make sure that the HPI can react quickly, fact-based and controlled in cyber incidents. You work closely with IT, research, data protection and the CISO team.

Your future tasks

SIEM: Detection Use Cases / Alarm Quality / EDR / Monitoring You'll disable recognition schemes and help reduce ''False Positives'' and make your contribution to gradually improving these systems From threat situation, asset context, log sources and HPI risks, you will remove Detection Use Cases You document rules and keep evidence and escalation criteria clean You pflegst Use-Case-Backlogs, define test cases and make Detection Coverage visible Ideally, the operation of monitoring/log management tools such as SIEM, EDR and systems such as Graylog/Grafana/Zabbix is not a new country for you

Incident Response You are working on initial measures and helping to maintain an incident register. The control of tickets and escalations and their follow-up to the successful completion and introduction of improvements are also part of your tasks. You help evaluate sources and ensure appropriate indicators. In doing so, you set evidence and Indicators of Compromise, perform simple timeline and root cause analyses and evaluate log or Endpoint artifacts. You start runningbooks, apply them and contribute to standardizing recurring incidents. You measure security codes, transfer them and derive Lessons Learned from them. If necessary, prepare handovers to the external forums cleanly.

Complete study or equivalent practical experience in computer science, IT security, system/web or Network administration, incident response or software engineering (open source, university or research proximity of advantage) 2 or more years full-time experience in heterogeneous IT, web, Linux, network or security-related environments IT Security Experience in open, decentralized, research-related environments with the operation of both proprietary solutions and cloud solutions For the SIEM / EDR / Monitoring, in-depth knowledge in handling logs are helpful Experience in handling and communication with different stakeholders High confidentiality and sense of responsibility Team-oriented, open, pragmatic way of working as well as hand-on implementation strength in a growing HPI security team readiness and proactive mentality Very good knowledge of German and English in word and writing Pragmatism and service orientation as well as readiness for presence at the workplace in Potsdam complete your profile

A challenging position in a renowned university research institute where you can move a lot The possibility to contribute significantly to ensuring the incident response and information security Regular training opportunities, insight into scientific research Regular team events and workshops For problems of any kind (including in the private environment) you can use our external employee advice for free Attractive offers for employees (Corporate Benefits) A certified company ticket/Germany ticket 30 days of vacation plus two extra days of Christmas Eve and New Year's Eve Numerous sports facilities (tennis and basketball court, beach volleyball field, Calisthenics Park) and participation in running events A workplace at the HPI campus in Potsdam-Babelsberg (S-Bhf. Griebnitzsee) with fast traffic connection to Berlin Did we awaken your interest? Then we look forward to your meaningful application documents incl. Letters of motivation, CV, Certificates of employment (replaced written confirmations), Certificates and References and Recognition. Please apply exclusively to our career page. We ask for your understanding that e-mail applications or CVs sent for preselection via e-mail cannot be taken into account. .