Incident Engineer (w/m)

Ärztekasse seeks a Mid-level Incident Engineer in Thônex to manage endpoint security, lead incident response, and support datacenter digitalization. On-site, full-time role requiring English proficiency.

Ärztekasse is currently undergoing a comprehensive datacenter renewal, a transformation that impacts its core products. This position plays a key role in that digitalization effort by designing and implementing effective security solutions to protect the organization's infrastructure and endpoints.

Responsibilities

• Investigate and resolve security alerts generated by Microsoft Defender on employee devices.
• Identify, analyze, and respond to security incidents occurring across endpoints, infrastructure, and applications.
• Lead incident response efforts and coordinate remediation steps with engineering and operations teams.
• Refine detection rules to minimize false positives and enhance the overall quality of security alerts.
• Create and maintain incident response playbooks, processes, and supporting tooling.
• Monitor security events using Microsoft Defender, SIEM, and IDS/IPS systems to drive continuous detection improvements.
• Conduct post-incident reviews and root-cause analyses, ensuring corrective actions are tracked to completion.
• Implement security best practices and harden systems against emerging threats.
• Participate in a future on-call rotation schedule.

Requirements

• At least three years of experience in security incident response, SOC operations, or a related field.
• Practical experience with Microsoft Defender for Endpoint (EDR) and endpoint security technologies.
• Strong understanding of security monitoring, SIEM platforms, and detection engineering principles.
• Knowledge of attack techniques and incident handling frameworks such as NIST or MITRE ATT&CK.
• Experience securing both Windows and Linux environments.
• Scripting and automation skills, preferably in Bash, Python, or Go.
• Fluency in English is required.

Nice to have

• Experience with Kubernetes.
• Relevant certifications such as GCIH, GCIA, or OSCP.
• Proficiency in German and French.

What the company offers

• A stimulating environment to find cool solutions to challenging complex requirements.
• Work in small agile teams where you can have impact and influence.
• Opportunity to have inspiring discussions with sharp engineers.
• Solution-driven culture that doesn't neglect the fun factor.

About the company

Ärztekasse operates with a solution-driven mindset, focusing on delivering effective results while maintaining a positive and enjoyable work atmosphere. The company values impact and influence, fostering an environment where employees can contribute meaningfully to the organization's goals.

• Work in small agile teams where you can have impact and influence.
• We are solution-driven, but we don’t neglect the fun factor.