14.10.2025 aktualisiert
60 % teilweise verfügbar
Security Expert - SOC/SIEM - TLPT Leader
Berlin, Deutschland
Berlin +100 km
B.Sc.Skills
ZutrittskontrollsystemeActive DirectoryKünstliche IntelligenzAmazon Web ServicesPenetration TestingMicrosoft AzureCloud-SicherheitCodeanalyseKomplexe NetzwerkeInformationssicherheitComputernetzwerkeContinuous IntegrationIncident ResponseIdentitätsmanagementIntrusion Detection und Prevention
IT-Sicherheitskompetenzen
- Threat Led Pentesting (TLPT), Red Teaming & DORA
- Cloud Security (AWS, Azure, Google Cloud)
- SOC Design & Management
- SIEM Implementation (Splunk, QRadar)
- Netzwerksicherheit
- Threat Detection & Response
- Risikobewertung & -management
- Entwicklung von Sicherheitsrichtlinien
- Incident Response
- Security Compliance (NIST, ISO, GDPR)
- Intrusion Detection Systems (Splunk, Snort, Suricata)
- Access Control, Active Directory (AD, ADD)
- Keycloak, OAuth, OWASP, OpenID Connect, PKI
- CyberArk, One Identity, Omada (PAM/IAM)
- ISO 27001 / ISO 21434 / BSI-Grundschutz
Erfahrung
Berufserfahrungmehr als 10 Jahre
Freelancer seit2023
Sprachen
DeutschMutterspracheEnglischverhandlungssicherFranzösischGrundkenntnisse
Projekthistorie
- Conducted comprehensive security assessments and performed regular vulnerability scans and penetration testing to identify and remediate vulnerabilities with Nessus
- Developed threat models, assessed risks, and implemented strategies to detect and respond to Advanced Persistent Threats (APTs).
- Together with a team of Cisco Meraki Engineers we designed, deployed, and managed firewalls and Intrusion Detection and Prevention Systems (IDPS)
- SIEM improvement for real-time monitoring, event analysis, and incident response.
- Utilized the MITRE ATT&CK framework for threat detection and response, and integrated Zero Trust
- Provided consulting for NIS2 Directive compliance, developed security policies and procedures, and ensured alignment with regulatory requirements.
- Developed incident response plans and playbooks, and provided support during security incidents to contain and remediate threats.
- Conducted security awareness training programs & helped during tabletop exercises
- Deployed Data Loss Prevention (DLP) SolarWinds
- Helped extending the current Public Key Infrastructure (PKI) to the client, on-premise and Cloud, together with current HSM/TPM environments
- Evaluated currenty VPN & AAA solutions, e.g. Kerberos, Diameter/ RADIUS
- Lead the development and execution of the bank’s Threat Intelligence & Red Teaming strategy, according to DORA and TIBER-EU requirements.
- Stakeholder management for Threat-Led Penetration Testing activities.
- Guide a team of cyber threat analysts, ensuring high-quality intelligence collection.
- Manage threat monitoring across open sources, deep web, and dark web, including scraping and analysis to identify emerging risks and threats, as well as working with data brokers.
- Manage red team exercises focused on critical business services.
- Develop and maintain governance frameworks, methodologies, and reporting structures for TLPT activities.
- Reporting to CISO, Head of IT and VP of Engineering
- Present threat intelligence assessments, red team outcomes, and resilience recommendations to senior management.
- Part of a unit specialiszing in SOC, SIEM, IoT, and OT Security Experts
- Architected and deployed a cloud-native security framework for a digital production platform in the automotive industry.
- Orchestrated the setup and management of a Next-Gen SIEM solution, utilizing AI and machine learning algorithms for advanced threat detection and behavior analytics.
- Implemented and customized threat intelligence feeds to enrich SIEM data and enhance incident response capabilities.
- Developed and executed a comprehensive cloud access control strategy, including IAM roles and policies, with a focus on Zero Trust principles on an enterprise level; collaboration with the vendor’s engineering team as well as IAM and PAM specialists on the client’s side
- Make or buy and vendor selection with the team for a global PAM solution implementation
- Collaborated on DevSecOps initiatives to embed security into the CI/CD pipeline, integrating tools like Jenkins, Terraform, and Ansible, across teams in Europe, India and US.
- Conducted regular penetration testing and vulnerability assessments, employing automated scanning tools such as Nessus and Qualys.
- Designed and documented security architecture patterns aligned with Cloud Security Best Practices, emphasizing containerization and microservices.
- Led a team of security analysts in threat hunting, utilizing machine learning algorithms to detect anomalies in network and system behavior.
- Spearheaded IoT and OT security initiatives, ensuring the secure integration and management of IoT devices and industrial control systems.
- Collaborated with engineers to implement security best practices for IoT device onboarding for several shop floors on a global scale and secure OT network segmentation.
- Part of a Digital Twin effort for a Machine Manufacturing Company from Japan