About the company
HelloFresh is a global digital-native FMCG company and the world's leading meal-kit provider, transforming the traditional food supply chain through a data-driven, on-demand model.
Responsibilities
- Responsible for maturing logging and monitoring of Cloud, IT and Application workloads through automation and IaC
- Filter, ingest and optimize security-specific events from large log streams such as App logs, Kubernetes logs, CloudTrail, CloudFlare and ELB logs
- Conduct threat hunts against file-less malware and APTs by leveraging EDR, OS and network telemetry acquired through specialized open-source tool set like Sysmon, Osquery, RITA and Zeek
- Use AI coding assistants to write scripts for security automation and data parsing and building detection logic
- Proficiency in using LLMs (e.g., Claude, ChatGPT, Gemini) to quickly summarize high-volume JSON logs, investigate and explain complex code snippets
- Develop advanced correlation and cross-correlation rules to detect sophisticated attacks and fraud cases
- Generate security metrics and reporting on incidents and effectiveness of the SOC operation
- Lead efficient Incident Detection and Response in AWS cloud and enterprise IT environments
- Serve as the shift's main communicator, updating Berlin SOC leadership and local IT/business stakeholders during active incidents
- Suggest detection rule tuning, SOP refinements, and contribute to the team knowledge base
- Mentor level (L1) SOC team, conduct purple teaming workshops and participate in CTFs
Requirements
- Proven security monitoring and incident response experience in public cloud environments
- Experience with cloud SIEM & SOAR platforms, DDoS mitigation and preventing tools and Layer-7 Web-based perimeter security controls
- Excellent programming (automation) skill with Python / Go
- Ability to use AI coding assistants to write and debug Python scripts for security automation and data parsing
- Proficiency in writing detection rules (Sigma, KQL) with the assistance of AI tools
- Understanding of network intrusion methods, network containment, segregation techniques and technologies such as Sandboxes and Intrusion Detection/Prevention Systems (ID/PS)
- Ability to analyze disparate log sources on demand and cut noise from the signal
- Good communication and reporting skills
- Command over log analysis stacks like ElasticSearch, Splunk/SumoLogic, Graylog
- Open to working on-call in rotational shifts
Conditions
- Competitive compensation package with a HelloFresh-subsidized Pension Scheme
- Hybrid working model
- Exclusive discounts on weekly HelloFresh box and office meals
- German language learning budget and access to the HelloFresh Academy
- Mental health support, transportation perks, working-parent-friendly benefits
- 24/7 gym access, wellbeing platforms like Headspace and Spill, sabbatical leave options