Security Baseline Deviation Specialist

About the role

Julius Baer is looking for a Security Baseline Deviation Specialist (100%, f/m/d) in Madrid. The role keeps the Security Baseline Configuration framework accurate and working end to end: helping technology teams set baseline requirements, ensuring scan and reporting data is accurate and proves compliance, and following up on deviations. It is a general, long-term position, initially focused on expanding the baseline to cover new technologies for Hardening and Exposure Management, and growing over time to include long-term planning.

Key responsibilities

• Work with technology owners to define and document security baseline requirements per technology in a version-controlled, peer-reviewed repository.
• Keep baselines current: annual review, version changes, mapping to recognised hardening standards, and accurate documentation of applicability status.
• Bring new technologies into baseline scope.
• Test with the technology and reporting warehouse teams that scan results reach the central reporting platform complete and accurate, and flag gaps or malformed records.
• Support audit and regulatory evidence requests: policy history, exception trail and scan evidence.
• Support remediation of security configuration deviations in the Exposure Management initiative, including adjusting assignment rules and evaluating false-positive requests.
• Track coverage and compliance deviations, follow up on remediation plans and exceptions with technology and IT service owners, and verify scan evidence.
• Share findings and observations with colleagues in Zurich and Madrid.

Required profile

• Bachelor's degree in computer science, information security, or equivalent practical experience.
• Three to five years of experience in a security-related technical role, such as configuration or hardening, governance, or data quality.
• Fluency in English.

Required skills

• Reasoning about data flows and spotting missing or malformed records.
• Verifying results against a defined standard, using automated tools or peer review where manual review is needed.
• Experience with auditable procedures and documentation.
• Explaining requirements to engineering teams and coordinating work across teams without direct authority.
• Working with tickets, exceptions and findings in a workflow tool, and with structured data and documents under version control.