Security Engineer - Detection & Response

JTL-Software builds the e-commerce software our customers run their businesses on. As the platform and the business grow, we are expanding our security team.

This is a newly created Staff-level position with end-to-end ownership of that area. You will own our SIEM and the detection content that runs on it, lead security investigations from first alert to resolution, and set the hardening standard across endpoints, identity, servers and cloud. You will also own the engineering relationship with the external partners who support us.

We are looking for someone who has built a detection capability. Our environment is predominantly Microsoft and Azure, and you will have genuine influence over the tooling, the architecture and the standards we adopt instead of maintaining decisions that were made before you arrived.

This is a senior individual contributor role. You set the detection and hardening standard for the security team, you work without a technical lead above you, and you report directly to the Director Cybersecurity & IT.

Build and own the SIEM

Detection engineering

Incident response

Hardening

Partners and tooling

• You have built or substantially rebuilt a detection capability, rather than only operating one designed by someone else
• You have written and tuned detection content in a production SIEM yourself, and are fluent in its query language
• You have personally investigated real security incidents from start to finish
• You have designed and rolled out a hardening baseline
• You script to a level where automation is your default: PowerShell, Python or equivalent
• You have set a technical standard that others followed, without formal authority over them
• Fluent English, written and spoken

• Remote-first within Germany, with the option to work remotely from eligible countries for up to 180 days per year
• Meal allowance of up to €115 net per month
• Ergonomic workspace allowance for your home office setup
• Regular team events, company-wide gatherings, and summer and Christmas parties to stay connected as a remote-first company
• EGYM Wellpass and JobRad subsidy
• Financial benefits including capital-forming payments (Vermögenswirksame Leistungen) and a company pension scheme