Director, Security Operations (Security Engineering)

Description

You will set the direction for how the company detects, investigates and responds to threats across all of its entities and platforms.

Your job is to move the CSIRT and SOC teams from baseline monitoring to proactive, intelligence-led defense on Google SecOps.

You report to the CISO and take the lead when a critical incident occurs.

You take over the existing CSIRT and SOC teams, based at the global headquarters in Berlin, and expand capacity where needed.

You work with local CISOs and security leads to give millions of daily customers one consistent level of protection.

The Security Team covers cyber defense, application security, cloud governance and risk mitigation, protecting users and vendors worldwide and helping technology scale securely under global standards.

The company operates in around 65 countries, is headquartered in Berlin, has been listed on the Frankfurt Stock Exchange since 2017 and is part of the MDAX index.

Responsibilities

• Lead the CSIRT and SOC managers and their teams, setting clear expectations and giving 360 feedback.
• Build an engaging, diverse workplace for the teams.
• Define the security operations strategy and run the OKR and roadmap process so that detection, incident response and threat intelligence work toward the same goals.
• Upgrade detection and response on Google SecOps (SIEM) with richer telemetry, turning threat actor TTPs into high-fidelity detections that cut noise, MTTD and MTTR.
• Coach teams in strong incident handling and act as incident commander for critical incidents, owning stakeholder communication and post-incident follow-up.
• Set consistent monitoring and incident response standards with local CISOs and security leads in every entity.
• Use data to find root causes and show measurable risk reduction against MITRE ATT&CK, while governing the budget closely.

Requirements

• You have led SOC and CSIRT functions in large, complex enterprise or technology organisations, balancing daily incident work with long-term improvement.
• You have managed complex, critical security incidents and built proactive threat hunting programmes.
• You know modern cloud-native SIEM and SecOps platforms well, including telemetry ingestion, detection-as-code and SOAR playbooks.
• You communicate clearly under pressure, turning technical incidents into risk insight for executives, regional CISOs and legal partners.
• You have recruited, retained and developed senior engineers and managers, including managers of managers, and run global follow-the-sun or escalation models.
• You have set and driven security operations metrics such as MTTD, MTTR and detection coverage against MITRE ATT&CK.
• You have worked in complex global platforms, food or logistics delivery networks, or multi-tenant cloud ecosystems.
• You hold certifications such as CISSP, CISM or advanced GIAC credentials (GCIH, GCFA, GNFA).
• You have monitored and responded to threats across multi-cloud environments (AWS, GCP).

Conditions

Hybrid working: you spend 2 days a week on the Berlin campus.

The company does not discriminate based on race, religion, colour, national origin, gender identity or expression, sexual orientation, age, marital or disability status, or any other characteristic.

Benefits

• 27 days of holiday, plus an extra day from the second and third year of service.
• Health checkups, meditation, yoga and gym access.
• Employee share purchase plan, sabbatical bank, public transport ticket discount, life and accident insurance, and corporate pension plan.
• A 1.000 € education budget, language courses, parental support, and access to Udemy Business online courses.
• Digital meal vouchers, food vouchers, an online canteen and corporate discounts.
• Relocation support for moving to Berlin, including a relocation hub and guide.
• Some benefits differ for intern, working student, fixed-term and part-time roles.