Cybersecurity Engineer | SOC & SIEM | EDR/XDR | Splunk | Elastic |

1/2024 – 12/2025

Responsible for establishing, leading and continuously improving SIEM and SOC operations for four organisations. Each organisation had its own SIEM environment, technical infrastructure, threat profile and compliance requirements. The role focused on detection engineering, improving alert quality, structuring triage, escalation and incident response processes, and guiding analysts in their daily operations. In addition, developed use cases and tuned detection rules to reduce noise and improve visibility into relevant threats. Translated technical findings, incident trends and SOC performance into dashboards, KPIs and periodic reports for the CISO, management team and executive leadership.

Security Operations Center (SOC)

1/2021 – 12/2024

Responsible for security monitoring and incident handling across multiple organisations operating in different technical environments. Progressed from Tier 1 to Tier 3, with responsibilities evolving from alert triage and escalation to in-depth incident investigation, threat hunting, incident response, and the improvement of detection rules and use cases. Investigated and correlated endpoint, identity, email and network alerts using Microsoft Sentinel, Splunk, Elastic Security, CrowdStrike, Microsoft Entra, Mimecast and Cisco Umbrella. Findings were documented, independently resolved or escalated, and structurally translated into stronger detections, more efficient SOC processes and improved alert quality.

Forschung

1/2020 – 12/2026

Responsible for leading and professionalising vulnerability management across four organisations and multiple external development, operations and technology partners. Identified, validated and risk-prioritised vulnerabilities based on technical severity, exploitability, external exposure, asset criticality and business impact.
Coordinated findings with system owners, IT teams, suppliers and security stakeholders, translating them into remediation plans, mitigating measures, SLA agreements and formal risk acceptance. Third-party environments, outsourced applications and supplier dependencies were also included in the assessment and follow-up process.

Risikoanalyse, Risikomanagement

1/2017 – 12/2020

Responsible for the management, support, and security of the internal IT environment. Managed workstations, user accounts, servers, endpoint security, and network components to ensure organizational availability and continuity. In addition to daily incident handling and end-user support, contributed to access management, onboarding and offboarding, hardware deployment, patch management, and system monitoring. Standardized administrative processes, documented recurring issues, and implemented structural improvements to make the IT environment more stable, secure, and manageable.

Identitätsmanagement, Operations Manager, Softwaredokumentation

1/2015 – 12/2017

Responsible for coordinating, assessing and ensuring the controlled implementation of IT changes within a complex enterprise environment. As part of a change and support team of approximately ten employees, supported an organisation of around 32,000 employees.
Prepared, scheduled and coordinated changes with technical teams, suppliers and operational stakeholders, with a strong focus on risk, availability and minimising disruption to business-critical processes. Monitored progress, dependencies, incidents and communication throughout the entire change lifecycle and ensured changes were implemented in a controlled and successful manner.

Change Management, Governance, Projektplanung, Risikoanalyse, Softwaredokumentation

1/2014 – 12/2015

Daily management, support, and improvement of the IT infrastructure within a public library organization. Managed workstations, user accounts, servers, applications, and network services, while supporting employees with incidents, disruptions, and change requests. Prepared, coordinated, and implemented technical changes in a controlled manner, assessing dependencies and potential impact in advance to minimize disruption. Standardized administrative processes, documented recurring issues, and improved maintenance routines to structurally support the stability, availability, and continuity of library services.

Identitätsmanagement, Incident-Management, Server Administration, Softwaredokumentation, Technischer Support