Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 3 days ago

Security Operations Engineer

DSwiss10 open roles

Where
Lisbon, Portugal
Work mode
Hybrid
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowSecurity Operations EngineerDSwiss · Lisbon, Portugal

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on DSwiss's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.7% of postings close within 7 days. Measured by our own scanner across the market. DSwiss postings stay open a median of 8 days.

Share of postings closed within
  1. 2.3%1 day
  2. 4.8%3 days
  3. 13.7%7 days
  4. 22.1%14 days
  5. 37.6%30 days
  6. 59.1%60 days
This job: posted 3 days ago

DSwiss median: 8 days open

The posting

Job description

Through SecureSafe, DSwiss operates a trusted Swiss infrastructure for the secure exchange, delivery and storage of confidential information. Banks, insurance companies, public institutions and other regulated organisations use our solutions when data protection, data sovereignty and security are business-critical. The platform is hosted in Switzerland, is ISO 27001-certified and is based on a zero-knowledge architecture. For 17 years, hundreds of companies and institutions have placed their trust in DSwiss.

We are hiring a Security Operations Engineer to run the day-to-day security operations of DSwiss and to act as Deputy to the CISO. This is a hands-on security role: you will operate and tune Microsoft Defender, own identity and access policy in Entra ID, run the vulnerability management process, build out our ELK/SIEM detection capability, lead security incident response and enable the secure use of AI across the company.

You will work closely with the CISO and with the IT and Infrastructure team in Operations. IT and Infrastructure operate the M365 tenant, the device fleet and the on-premises platform; this role defines the security controls those teams operate within, holds the privileged security roles, and verifies that the controls are effective. Keeping that boundary clean is part of the job.

A core expectation is continuous improvement of security operations: reducing manual triage through automation, raising detection quality, keeping audit evidence current, and reporting security posture in a way that supports decisions. During planned CISO absences you maintain operational continuity, coordinate incident response and escalate appropriately.

What we are looking for

Required competencies

  • Practical experience operating Microsoft Defender: alert triage, investigations, policy tuning, detection improvement.
  • Hands-on experience with Entra ID security configuration: Conditional Access, MFA, privileged access and PIM, access reviews.
  • Working knowledge of endpoint security controls on macOS and Windows and of how Intune and JAMF enforce them; you do not need to run the fleet, you need to know what to require of it.
  • Deep hands-on Nessus experience, essential for this role: scanner architecture, credentialed scanning, scan policy and plugin tuning, false positive handling, risk-based prioritisation and remediation tracking. Scanmeter or equivalent external scanning is a plus.
  • Strong ELK experience, essential for this role: Elasticsearch architecture (cluster design, index management and lifecycle, ingest pipelines, Elastic Agent/Beats/Logstash), and fluency writing queries in Kibana Dev Tools (Query DSL, KQL, ES|QL) for investigations, detection rules and dashboards.
  • Experience handling security incidents end-to-end, including evidence collection and documentation.
  • Solid network fundamentals relevant to security: DNS, DHCP, VPN, segmentation, traffic analysis.
  • Strong documentation discipline: access decisions, procedures, incident notes, audit evidence.
  • Demonstrable continuous-improvement mindset: automate, standardise, measure outcomes, reduce manual effort and response times.
  • Hands-on exposure to AI tools and workflows, with the ability to support secure, practical adoption in a business environment.
  • Fluent English.

Certifications, required or obtained within the first 6 to 12 months

  • CompTIA Security+ or equivalent baseline security certification.
  • Microsoft SC-200 (Security Operations Analyst) or equivalent demonstrated competence.

Nice to have, certifications

  • Microsoft SC-300 (Identity and Access Administrator), SC-100 (Cybersecurity Architect).
  • CompTIA CySA+ or Network+, or a GIAC certification (GCIH, GCIA or similar).
  • ISO/IEC 27001 Lead Implementer or Lead Auditor.
  • SIEM or security analytics vendor training.
  • Elastic Certified Analyst or Elastic Certified Engineer.
  • Tenable Nessus or Tenable Vulnerability Management certification.

Nice to have, skills and experience

  • Scripting and automation (PowerShell, Bash, Python, KQL) applied to security operations.
  • Experience in regulated or ISO 27001-certified environments: audit readiness, investigations, evidence handling.
  • Working knowledge of privacy frameworks such as GDPR and the Swiss FADP, and of how security controls support data protection obligations (records of processing, data subject requests, breach notification timelines).
  • Experience translating security requirements into pragmatic employee guidance: policies, playbooks, enablement.
  • Familiarity with GitLab and SaaS access governance.
  • German language skills.

We look for people who demonstrate Care, Curiosity, Ownership, Empowerment and Transparency in daily execution: clear communication, dependable follow-through, continuous improvement and respectful collaboration. In this role that also means stating security requirements early and plainly to the teams that operate within them, and treating IT and Infrastructure as partners rather than as an audit subject.

What you will do

1. Endpoint security operations (Microsoft Defender)

  • Own Defender end-to-end: agent deployment and policy, alert monitoring, investigations, policy tuning, noise reduction and detection quality.
  • Define the endpoint hardening baselines and compliance gate criteria that IT applies through Intune and JAMF, and verify they are applied.
  • Deploy and maintain security tooling on the fleet using the security roles held in Intune and JAMF.

2. Identity and access policy (Entra ID)

  • Own Conditional Access, MFA design, privileged access and PIM, administrative separation and periodic access reviews.
  • Define and maintain the admin role model across Entra, Intune, JAMF, GitLab and SaaS tools; review privileged role assignments.
  • Set the access revocation requirements for offboarding and check the evidence IT produces.

3. Vulnerability management (Nessus, Scanmeter)

  • Run and improve internal and external scanning coverage, schedules and reporting across endpoints and infrastructure using Nessus and Scanmeter.
  • Own the Nessus deployment itself: scanner placement, credentialed scanning, scan policies and plugin tuning, asset grouping and reporting templates.
  • Prioritise findings by risk and business impact, assign owners and deadlines, and track closure with IT and Infrastructure.
  • Maintain a durable reporting cadence and measurable remediation performance.

4. SIEM, logging and detection (ELK/SIEM)

  • Own the ELK stack as a security platform: architecture (Elasticsearch cluster, Elastic Agent/Beats, Logstash and ingest pipelines, index lifecycle), ingestion health, source coverage and retention.
  • Write and maintain queries in Kibana Dev Tools (Query DSL, KQL, ES|QL) for investigations, detection rules, dashboards and correlation across endpoint, identity and infrastructure telemetry; operationalise detection use cases with playbooks.
  • Produce concise security posture reporting for the CISO and stakeholders: trends, improvements, key risks.

5. Security incident response

  • Lead security incident handling: triage, containment coordination, evidence collection, remediation follow-up and lessons learned.
  • Maintain incident response runbooks and coordinate IT and Infrastructure during security incidents.
  • Support investigations that require evidence handling to an audit or legal standard.

6. Secure enablement of AI

  • Enable and support secure use of AI tools and workflows across the company, with the CISO and key stakeholders.
  • Define and implement practical guardrails: approved tools, data handling rules, access controls, logging and monitoring, user guidance.
  • Review new AI use cases pragmatically and support employees with documentation and onboarding guidance.

7. Audit readiness and security evidence

  • Maintain security runbooks, operational procedures and control evidence for ISO 27001 and data protection audits.
  • Keep access management, incident and vulnerability records in a state that can be evidenced at any time.

8. Automation and optimisation (mandate across the role)

  • Identify and implement automation in alert triage, access reviews, vulnerability reporting and evidence collection.
  • Reduce manual effort and response times; rationalise security tooling and configurations and keep cost awareness.

9. Security vendors and deputy CISO

  • Manage security tooling vendors: renewals, escalation paths, performance and roadmap alignment.
  • Act as Deputy to the CISO during absences: maintain day-to-day security operations, coordinate incident response, take operational decisions and escalate appropriately.

How we evaluate success in the first 3 to 6 months

  • Defender operations: Consistent triage workflow; reduced alert noise; fewer repeated endpoint findings; timely, well-documented investigations
  • Identity and access: Conditional Access and MFA coverage documented and enforced; privileged roles under PIM; first access review cycle completed with evidence
  • Endpoint compliance: Hardening baselines and compliance criteria published to IT; compliance gaps visible and trending down
  • Vulnerability management: Consistent Nessus and Scanmeter coverage; risk-driven prioritisation; owners and deadlines on every finding; closure cadence reported monthly
  • SIEM and detection: Cluster and ingestion architecture documented and stable; agreed source coverage; detection rules and dashboards built from own queries; first use cases live with playbooks
  • Incident response: Runbooks current; at least one tabletop or real incident handled end-to-end with lessons learned recorded
  • AI enablement: Approved tool list and data handling guidance published; review process for new use cases in operation
  • Audit readiness: Security evidence for ISO 27001 controls retrievable without preparation
  • Deputy coverage: Demonstrably stable security operations during CISO absence, with appropriate escalation and decision-making

Job benefits

SecureSafe takes its values seriously in practice, not just on a slide deck. Transparency, ownership, empowerment, curiosity, and care shape how the team works and how decisions get made. You'll have:

  • 25 Days of Vacation: Recharge and thrive with above-market holiday time, reflecting our people-first approach to work-life balance.
  • Empowered to Make an Impact: Every voice matters—you're encouraged to drive improvements, contribute ideas, and create real value from day one.
  • Learn from the Best: Grow your skills in a high-performing, international team of experienced and talented professionals.
  • Meal allowance, health insurance coverage, and public transportation allowance.
  • Work for a company committed to sustainability—our data centers operate climate-neutral
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against DSwiss's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on DSwiss's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    DSwiss's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.