[Hiring] Staff Security Engineer - Detection & Response @JTL-Software GmbH

Role Description

JTL-Software builds the e-commerce software our customers run their businesses on. As the platform and the business grow, we are expanding our security team. This is a newly created Staff-level position with end-to-end ownership of that area.

• Own our SIEM and the detection content that runs on it.
• Lead security investigations from first alert to resolution.
• Set the hardening standard across endpoints, identity, servers, and cloud.
• Own the engineering relationship with external partners.
• Build and own the SIEM.
• Take ownership of the platform from the implementation partner.
• Own data source onboarding, parsing, normalization, and coverage.
• Make and justify explicit decisions on log coverage, retention, and ingest cost.
• Develop the platform as the estate grows.

Detection engineering:

• Write, tune, and maintain the detection content, beyond the vendor's default rule set.
• Map coverage against the techniques relevant to our estate and close the gaps that matter.
• Treat detections as code: version control, review, testing, and a defined process for false positives.
• Convert offensive security findings into detections.

Incident response:

• Investigate and lead the technical side of security incidents end to end.
• Threat hunting against our own telemetry, proactively rather than in response to a report.
• Own the technical half of the incident response process and refine it after each event.

Hardening:

• Design and roll out security baselines across endpoints, servers, identity, and cloud.
• Work with IT and engineering to get them applied.
• Measure configuration drift and close it.

Partners and tooling:

• Own the engineering relationship with our external security partners: scope, escalation, and expectations.
• Make build-versus-buy decisions on detection and response tooling, including the cost implications.

Qualifications

• Built or substantially rebuilt a detection capability.
• Written and tuned detection content in a production SIEM.
• Fluent in SIEM query language.
• Personally investigated real security incidents from start to finish.
• Designed and rolled out a hardening baseline.
• Scripting skills in PowerShell, Python, or equivalent.
• Set a technical standard that others followed, without formal authority.
• Fluent English, written and spoken.

Benefits

• Remote-first within Germany, with the option to work remotely from eligible countries for up to 180 days per year.
• Meal allowance of up to €115 net per month.
• Ergonomic workspace allowance for your home office setup.
• Regular team events, company-wide gatherings, and summer and Christmas parties.
• EGYM Wellpass and JobRad subsidy.
• Financial benefits including capital-forming payments and a company pension scheme.

Company Description

JTL is one of the leading providers of e-commerce software in the German-speaking region – with around 450 employees across the group and 50,000 customers from a wide range of industries. We develop scalable, flexible solutions for the online retail of the future – from ERP systems to shop and marketplace integrations.

Fairness and respect are part of our everyday practice. Are you committed, curious, and eager to work in a team while taking on responsibility? Are you looking for a job where Monday isn’t the worst day of the week? Then we look forward to receiving your application!