🚀 Staff Security Engineer, GSOC bei Delivery Hero in Berlin - Senior Architect for Security Automation & Monitoring

Company Overview

Delivery Hero is a global pioneer in the local delivery industry, operating in over 65 countries. Based in Berlin, we leverage advanced technology to provide fast and easy delivery experiences for millions of users. We are a fast-moving, MDAX-listed company that empowers creative minds to build impactful solutions within a diverse and inclusive ecosystem.

Your Role as Staff Security Engineer

As a Staff Security Engineer for our Global SOC, you will become the technical cornerstone of our security monitoring and threat detection strategy. In an environment handling millions of daily orders across logistics and FinTech, you will architect systems that ensure high-fidelity detection in line with global compliance frameworks. This role is designed for a builder who treats threat detection as a software engineering discipline, focusing on automation rather than manual monitoring.

Key Responsibilities

• Architect and scale security log management on AWS and modern SIEM/SOAR platforms like Google SecOps.
• Drive Detection as Code initiatives, ensuring all detection rules and automated enrichments are version-controlled and deployed via CI/CD pipelines.
• Integrate Cyber Threat Intelligence (CTI) to create an intelligence-led detection strategy mapped to the MITRE ATT&CK framework.
• Design high-fidelity alert workflows and automated triage processes to streamline incident response and containment.
• Act as a primary technical interface between the Global SOC, engineering teams, and CISOs to translate complex architectures into actionable business terms.
• Mentor detection engineers and regional teams to elevate technical standards across the organization.
• Utilize data-driven metrics to identify systemic gaps and propose strategic security investments.

What You Bring

• At least 7 years of cybersecurity experience, with 5+ years focused on SOC or Threat Detection Engineering.
• Deep architectural expertise in SIEM/SOAR (specifically Google SecOps/Chronicle) and cloud environments (AWS/GCP).
• Proficiency with Git, GitHub, and CI/CD pipelines for managing infrastructure and rules as code.
• Proven track record in triaging alerts across public clouds, identity providers (Okta, Entra ID), and EDR platforms.
• Exceptional communication skills and the ability to influence stakeholders across multiple domains.
• Experience with AI/LLM integration for automated alert analysis and data enrichment is a significant advantage.
• Knowledge of global frameworks such as PCI-DSS, GDPR, or NIS2 is highly regarded.

Benefits and Growth

• Flexible hybrid working model at our Berlin campus.
• Generous holiday allowance starting at 27 days.
• Individual development support including a 1.000 € educational budget and access to Udemy.
• Comprehensive wellbeing offers, including gym subsidies and health checkups.
• Financial perks like the Employee Share Purchase Plan and corporate pension schemes.
• Full relocation support for a smooth transition to Berlin.