Staff Security Engineer - Detection and Response

Your mission JTL-Software builds the e-commerce software our customers run their businesses on. As the platform and the business grow, we are expanding our security team. This is a newly created Staff-level position with end-to-end ownership of that area. You will own our SIEM and the detection content that runs on it, lead security investigations from first alert to resolution, and set the hardening standard across endpoints, identity, servers and cloud. You will also own the engineering relationship with the external partners who support us. We are looking for someone who has built a detection capability. Our environment is predominantly Microsoft and Azure, and you will have genuine influence over the tooling, the architecture and the standards we adopt instead of maintaining decisions that were made before you arrived. This is a senior individual contributor role. You set the detection and hardening standard for the security team, you work without a technical lead above you, and you report directly to the Director Cybersecurity & IT. Build and own the SIEM Take ownership of the platform from the implementation partner, to a depth that allows you to defend or revise its design decisionsOwn data source onboarding, parsing, normalisation and coverageMake and justify explicit decisions on log coverage, retention and ingest costDevelop the platform as the estate grows, rather than leaving it as delivered Detection engineering Write, tune and maintain the detection content, beyond the vendor's default rule setMap coverage against the techniques relevant to our estate and close the gaps that matterTreat detections as code: version control, review, testing, and a defined process for false positivesConvert offensive security findings into detections Incident response Investigate and lead the technical side of security incidents end to endThreat hunting against our own telemetry, proactively rather than in response to a reportOwn the technical half of the incident response process and refine it after each event Hardening Design and roll out security baselines across endpoints, servers, identity and cloudWork with IT and engineering to get them applied, including where that requires making the caseMeasure configuration drift and close it Partners and tooling Own the engineering relationship with our external security partners: scope, escalation and expectationsMake build-versus-buy decisions on detection and response tooling, including the cost implications Your profile You have built or substantially rebuilt a detection capability, rather than only operating one designed by someone elseYou have written and tuned detection content in a production SIEM yourself, and are fluent in its query languageYou have personally investigated real security incidents from start to finishYou have designed and rolled out a hardening baselineYou script to a level where automation is your default: PowerShell, Python or equivalentYou have set a technical standard that others followed, without formal authority over themFluent English, written and spoken Why us? Remote-first within Germany, with the option to work remotely from eligible countries for up to 180 days per yearMeal allowance of up to €115 net per monthErgonomic workspace allowance for your home office setupRegular team events, company-wide gatherings, and summer and Christmas parties to stay connected as a remote-first companyEGYM Wellpass and JobRad subsidyFinancial benefits including capital-forming payments (Vermögenswirksame Leistungen) and a company pension scheme About Us JTL is one of the leading providers of e-commerce software in the German-speaking region – with around 450 employees across the group and 50,000 customers from a wide range of industries. We develop scalable, flexible solutions for the online retail of the future – from ERP systems to shop and marketplace integrations. Fairness and respect are part of our everyday practice. Are you committed, curious, and eager to work in a team while taking on responsibility? Are you looking for a job where Monday isn’t the worst day of the week? Then we look forward to receiving your application!