IT Security Engineer (all genders)

Support us in designing the insurance experience of the future. As an IT Security Engineer you own IT Security Operations at getolo end to end: running our detection and response capability day to day, keeping endpoints and infrastructure hardened, and driving incidents, vulnerabilities and findings to closure. Security operations is the core of this role. Beyond it, you bring an operator's perspective into how we design systems and into our governance work, to ensure control effectiveness. This is a full-time hybrid role, with 1–2 days per week working from our Berlin office. Requirements Your MissionSecurity Operations - your primary function Run and continuously improve our SIEM: log source onboarding, detection rules, tuning, alert qualityAutomate orchestration and response with SOAROperate endpoint protection across our fleetTriage and manage alerts, driving them to closure or escalationLead incident management from detection through containment, recovery and post-incident reviewDetect and remediate configuration drift against hardening baselines; run technical auditsOversee vulnerability management: scanning, prioritisation, and remediation tracking with IT and engineeringPlan and coordinate penetration tests (internal and with external providers) and drive remediationSecurity Architecture - supporting Contribute to security best practices and standards for infrastructure, endpoints, identity and SaaSBring security design input into new systems and projects earlyAct as a security advisor to IT, engineering and the wider businessSecurity GRC - supporting Feed operational reality into security policies, the risk register and control designSupport internal and external audits with evidence collection and remediation of findingsContribute to security awareness trainingsSupport third-party and vendor security assessmentsDeliver operational input for management reporting on security posture, KPIs and incidents What You Will Need to Succeed 4+ years in security operations, SOC, blue team or a comparable hands-on security roleHands-on SIEM experience: onboarding sources, writing and tuning detections, running investigationsKnowledge of orchestration and response with SOARSolid experience with EDR and MDM-managed endpoint fleets (macOS and Windows)Practical incident response experience and the composure to lead an incidentVulnerability management from scanning through remediation, including pentest coordinationWorking knowledge of ISO 27001 or comparable frameworks (Grundschutz, NIST CSF, CIS Controls, DORA) and how controls map to daily operationsScripting for automation (Python, PowerShell, Unix shell)Clear communicator who can explain risk to non-security stakeholders and write for managementExperience with cloud first tech stacks running on SaaS and PaaSFluent English What Would Make You Stand Out Certifications such as GCIH, GCIA, CISSP or Security+Cloud and identity security experience (e.g. Microsoft 365 / Entra ID, AWS or GCP)Detection engineering or threat hunting backgroundPrior involvement in audits (ISO 27001, SOC2 or similar)Benefits Why getolo? 🌴 Salary & Vacation Attractive fixed salaryStart with 28 vacation days, with an increase every two years (capped at 30 days). Holidays on December 24th and 31st. 🧑‍💻 Mobility & Flexibility Choose between a free Swapfiets bike, or a Berlin/Brandenburg ticket (“VBB - Jobticket”) or BVG “Deutschlandticket” subsidized by usWork hybrid - from your home office or in our office in Berlin-MitteWork abroad in the EU for up to 60 days 🧘 Health Benefit from free coaching sessions with nilo.health, our mental health toolTest our products yourself! Choose between dentolo, petolo or vitolo 📚 Development Learning Budget starting from 750 € per yearRegular (360 degree) feedback 🌍 Berlin Based, International Mindset We communicate, collaborate, and celebrate in English to ensure everyone is includedOur diverse team spans from 33 different countries 🧬 Values Our values a