Cybersecurity Engineer - Monitoring & Incident Response

About the role

Roche's Global Security Monitoring and Incident Response (MIR) team protects its networks and users from evolving threats. As a Cybersecurity Engineer you will help safeguard proprietary information and patient data, keep computer systems clean and provide a safe information environment. You will monitor security signals, identify signs of abuse or compromise of on-premise and cloud resources, and handle incidents, requests from experts and enquiries from end users. On-call rotation during weekends is encouraged, and you will be mobilized during major incidents.

Key responsibilities

• Monitor and respond to security events in a global environment
• Gather feedback and data to continuously strengthen detection and response processes
• Partner with other Cybersecurity teams to drive continuous improvement
• Improve platforms and automations that support detection, investigation and response
• Turn investigations and lessons learned into structural improvements across the company
• Brief peers and leadership on threats relevant to the group and explain security concepts to senior management
• Organize knowledge-sharing sessions with partners and peers, mentor team members and communicate to a non-technical audience

Required profile

• Bachelor's degree in a technical field and 5+ years of information security experience, including at least 3 years in a SOC/CERT/CSIRT environment
• Ability to design and implement complex security systems and processes
• Ability to analyze, triage and escalate incidents, and to decide under pressure with partial information
• Fluent spoken and written English

Required skills

• Knowledge of detection engineering and threat-hunting concepts
• Scripting and programming (Python, JavaScript, Go, Rust)
• Operating systems (Windows, Linux, macOS)
• Cloud security for major providers
• Preferred: network and endpoint monitoring in large environments, modern IAM controls (Zero Trust, Identity-Aware Proxies, Active Directory Security), logging and detection pipelines, vulnerability assessment and hardening, and defensive and offensive security toolsets