Senior Security Engineer (SOC) (m,f,x)

We’re looking for a new teammate to join us on the journey of keeping HelloFresh a trusted name - someone with a passion for security and appetite for new challenges. Security Engineers work in a variety of ways to constantly iterate and improve HelloFresh’s security posture.

As an Experienced SOC Analyst at HelloFresh, you’ll bring advanced expertise to our SOC team in Manila. Working in a flat team structure, you’ll act as a Senior Engineer handling escalations from junior analysts, driving complex investigations, and ensuring accurate incident reporting.

You’ll be the point of contact for Berlin SOC leadership during major incidents, mentor junior colleagues, and help refine SOC processes. This is a hands-on technical role with strong responsibility, requiring both depth in incident response and leadership qualities to keep the operations effective

Above all, we are looking for people who will make HelloFresh better. We believe there are many different ways of developing skills and we love diverse experiences! So even if you don’t “tick all the boxes” but think you’d thrive in this role, we would really like to learn more about you.

• for maturing logging and monitoring of Cloud, IT and Application workloads through automation and IaC
• Filter, ingest and optimize security-specific events from large log streams such as App logs, Kubernetes logs, CloudTrail, CloudFlare and ELB logs etc.
• Conduct threat hunts against file-less malware and APTs by leveraging EDR, OS and network telemetry acquired through specialized open-source tool set like Sysmon, Osquery, RITA and Zeek
• AI-Enhanced Coding: Ability to use AI coding assistants to write scripts for security automation and data parsing and building detection logic.
• Investigation Acceleration: Proficiency in using LLMs (e.g., Claude, ChatGPT, Gemini) to quickly summarize high-volume JSON logs, investigate and explain complex code snippets etc.
• Develop advanced correlation and cross-correlation rules beyond what is available out of the box to detect sophisticated attacks and fraud cases
• Generate security metrics and reporting on incidents and effectiveness of the SOC operation
• Lead efficient Incident Detection and Response in AWS cloud and enterprise IT environments
• Shift Communication: Serve as the shift’s main communicator, updating Berlin SOC leadership and local IT/business stakeholders during active incidents.
• Playbook & Process Improvement: Suggest detection rule tuning, SOP refinements, and contribute to the team knowledge base to reduce false positives and improve workflows.
• Mentor level (L1) SOC team, conduct purple teaming workshops and participate in CTFs

What you’ll bring

• Proven security monitoring and incident response experience in public cloud environments
• Experience with cloud SIEM & SOAR platforms, DDoS mitigation and preventing tools and Layer-7 Web-based perimeter security controls
• Excellent programming (automation) skill with Python / Go
• Experience with cloud SIEM & SOAR platforms, DDoS mitigation and preventing tools and Layer-7 Web-based perimeter security controls
• AI-Enhanced Coding: Ability to use AI coding assistants to write and debug Python scripts for security automation and data parsing.
• Detection Logic: Proficiency in writing detection rules (Sigma, KQL) with the assistance of AI tools to optimize query performance and coverage.
• Understanding of network intrusion methods, network containment, segregation techniques and technologies such as Sandboxes and Intrusion Detection/Prevention Systems (ID/PS)
• Ability to analyze disparate log sources on demand and cut noise from the signal
• Good communication and reporting skills
• Command over log analysis stacks like ElasticSearch, Splunk/SumoLogic, Graylog
• Open to working on-call in rotational shifts
• Meeting response time and incident closure metrics, with thorough documentation and timely stakeholder updates.