Cybersecurity Engineer – Purple Team / Red Team

Are you passionate about offensive cybersecurity and interested in applying knowledge of real-world threats to continuously improve the SOC? We are looking for a Senior Cybersecurity / Purple Team specialist to participate in international cybersecurity projects, working on Threat-Led Validation, Adversary Emulation, Red/Purple Team, Threat Hunting, and Detection Engineering. The selected candidate will help validate and improve threat detection, investigation, and response capabilities, working with enterprise environments and Microsoft security technologies.

Responsibilities:

• Develop security scenarios based on Threat Intelligence, recent incidents, business risks, and detection gaps.
• Plan and conduct Adversary Emulation, Red Team, Purple Team, and Atomic Testing campaigns.
• Map adversary actions and behaviors to MITRE ATT&CK.
• Validate telemetry and detection capabilities in collaboration with Detection Engineering and Threat Hunting teams.
• Create, validate, and optimize KQL queries, correlation rules, and behavioral detections.
• Work with Microsoft Sentinel and Microsoft Defender XDR.
• Evaluate comprehensive SOC capabilities for incident detection, enrichment, investigation, escalation, containment, and documentation.
• Identify blind spots, false negatives, and opportunities for security control improvements.
• Document evidence and conduct root cause analysis.
• Define and track remediation actions with control owners.
• Conduct re-testing to verify correct implementation of remediation actions.
• Create scripts, automations, integrations, and reusable tools.
• Work with Python, PowerShell, Bash, APIs, Git, and CI/CD.
• Prepare metrics and reports on MITRE ATT&CK coverage, control effectiveness, detections, and remediation progress.
• Participate in Purple Team Workshops, After-Action Reviews, and knowledge transfer sessions.
• Contribute to the continuous improvement of SOC detection and response capabilities.

University degree in Cybersecurity, Computer Science, Engineering, or equivalent. A combination of specialized professional training and relevant cybersecurity work experience will also be a plus.

Minimum of 3 years of hands-on experience in offensive cybersecurity, Adversary Emulation, Pentesting, Detection Engineering, Threat Hunting, Incident Response, or related disciplines. Minimum of 3 years of hands-on experience in Red Team or Purple Team, including planning and executing exercises in enterprise environments. Proven experience translating offensive exercise findings into improvements in telemetry, detection, investigation, response, and remediation. Experience with MITRE ATT&CK and Threat Intelligence. Deep knowledge of attack and post-exploitation techniques in:

• Windows
• Linux
• Active Directory
• Microsoft Entra ID
• Microsoft 365
• Networks
• Cloud

Experience with SIEM, EDR/XDR, SOAR, and Network Security Monitoring technologies. Experience with Microsoft Sentinel. Experience with Microsoft Defender XDR. Good knowledge of KQL (Kusto Query Language). Experience with Python, PowerShell, or Bash. Familiarity with APIs, version control systems, and CI/CD environments. Ability to work in enterprise, distributed environments with multiple stakeholders. Ability to document technical findings and translate them into actionable improvements. Autonomy, analytical mindset, and results-oriented approach.

Professional proficiency in English.

Madrid

One extra day off on your birthday to celebrate it your way! Enhanced paid holidays for a better work-life balance. Access to private health insurance for your peace of mind. Additional vacation days based on tenure, because we value your rest and well-being. At Pasiona we believe in diversity and equal opportunities. We encourage everyone to apply, regardless of their gender, age, disability, sexual orientation, gender identity, ethnicity, religion, or any other personal or social circumstance.