SOC Automation Analyst - SOAR & Incident (all humans)

Make a difference in the financial life of millions of people: At Erste Digital you are co-creating the digital future, in which better financial health is possible. #believeinyourself

Our Cyber Defense Center protects the digital services used by millions of customers across Erste Group.

We are looking for a SOC Automation Analyst who combines security operations experience with an engineering mindset. You will work with real security incidents - but also look beyond the individual alert and ask: How can we detect this earlier, enrich it faster and respond more consistently next time?

Your mission is to turn repeatable SOC activities into reliable automation, allowing our analysts to focus on where human judgment makes the difference.

• Identify investigation and response activities suitable for automation

• Design, build and maintain SOAR playbooks for enrichment, triage, notification, containment and remediation

• Integrate security and IT platforms through APIs, webhooks and connectors

• Develop automation using Python, PowerShell or comparable technologies

• Build reliable workflows with appropriate approval points, error handling, logging, permissions and monitoring

• Analyze incidents and identify opportunities to improve playbooks, automations and response procedures

• Collaborate with SOC analysts, security engineers, threat intelligence specialists and service owners across our international organization

• Hands-on experience investigating security alerts or incidents in SOC, incident response or security engineering environments

• Experience automating security or operational processes using Python or comparable scripting technologies

• Good understanding of APIs, integrations and security technologies such as SIEM, EDR, identity or cloud security

• Sound judgment about what to automate, where human approval is needed and how to manage automation risk

• A structured approach to building, testing and maintaining reliable production automation

• Understanding of attacker behavior and frameworks such as MITRE ATT & CK

• Professional fluency in English

• Nice to have: Experience with SOAR platforms, detection engineering, threat hunting, cloud/DevOps technologies or related security disciplines is a plus. Relevant security certifications and German language skills are also welcome.
  

Not sure you meet every qualification? We still encourage you to apply. We are interested in your capabilities, your thinking and what you can build - not in matching every keyword.

Strong security operations combine technology, disciplined processes and capable people. Our goal is not to remove people from security operations, but to automate predictable actions so they can focus on investigations and decisions where their expertise matters most.

Erste Group considers the diversity of its employees as key to innovation and success. As employer we are proud to offer everyone equal chances, irrespective of age, skin colour, religious belief, gender, sexual orientation or origin.