SOC Automation Analyst - SOAR & Incident (all humans)

Make a difference in the financial life of millions of people: At Erste Digital you are co-creating the digital future, in which better financial health is possible. believeinyourself

We are part of Erste Group – the largest banking group in Central and Eastern Europe with more than 2,500 branches and over 45,000 employees. Our more than 2,000 IT experts and enthusiasts are the bank's Digital Muscle.

Help us automate the work that should not require an analyst

Our Cyber Defense Center protects the digital services used by millions of customers across Erste Group.

We are looking for a SOC Automation Analyst who combines security operations experience with an engineering mindset. You will work with real security incidents - but also look beyond the individual alert and ask: How can we detect this earlier, enrich it faster and respond more consistently next time?

Your mission is to turn repeatable SOC activities into reliable automation, allowing our analysts to focus on where human judgment makes the difference.

What to do:

• Identify investigation and response activities suitable for automation
• Design, build and maintain SOAR playbooks for enrichment, triage, notification, containment and remediation
• Integrate security and IT platforms through APIs, webhooks and connectors
• Develop automation using Python, PowerShell or comparable technologies
• Build reliable workflows with appropriate approval points, error handling, logging, permissions and monitoring
• Analyze incidents and identify opportunities to improve playbooks, automations and response procedures
• Collaborate with SOC analysts, security engineers, threat intelligence specialists and service owners across our international organization

You check these boxes:

• Hands-on experience investigating security alerts or incidents in SOC, incident response or security engineering environments
• Experience automating security or operational processes using Python or comparable scripting technologies
• Good understanding of APIs, integrations and security technologies such as SIEM, EDR, identity or cloud security
• Sound judgment about what to automate, where human approval is needed and how to manage automation risk
• A structured approach to building, testing and maintaining reliable production automation
• Understanding of attacker behavior and frameworks such as MITRE ATT&CK
• Professional fluency in English

Nice to have: Experience with SOAR platforms, detection engineering, threat hunting, cloud/DevOps technologies or related security disciplines is a plus. Relevant security certifications and German language skills are also welcome.

Not sure you meet every qualification? We still encourage you to apply. We are interested in your capabilities, your thinking and what you can build - not in matching every keyword.

Why you will like us:

• Real ownership. Work directly with analysts and engineers to improve production security operations across a major European banking group.
• Automate and improve. Go beyond resolving incidents – eliminate repetitive work, challenge existing processes and help us build more scalable security operations.
• Meaningful challenges. Work across technologies, entities and countries, where reliability, security and operational effectiveness matter.
• Learn and collaborate. Work with security specialists across countries, share knowledge and grow across security operations, engineering and automation.
• Health Care – Taking care of your health is important. That’s why we contribute to your above standard medical examination and provide a helpline in case of hard lifetime situations. You also receive a salary compensation during sick leave
• Work-Life-Balance – Sabbatical, paternity leave, contribution to marriage & childbirth, 4 days of extra holiday per year, contribution to the 3rd pillar and MultiSport card. This is how we promote a balance between work, leisure, and family
• Employee Referral Program – Become a talent scout for career opportunities in IT. We are rewarding every successful referral for Erste Digital
• A competitive and performance-related salary dependent on your professional and personal qualifications is granted - we are obliged by law to quote the minimum wage of EUR 2.700,-- gross per month for this full time position. But this is just a formality, we are more than happy to discuss your actual expectations.

Interested?

Strong security operations combine technology, disciplined processes and capable people. Our goal is not to remove people from security operations, but to automate predictable actions so they can focus on investigations and decisions where their expertise matters most.

The way we are:

Erste Group considers the diversity of its employees as key to innovation and success. As employer we are proud to offer everyone equal chances, irrespective of age, skin colour, religious belief, gender, sexual orientation or origin.