IT Security Analyst – Cyber Defence Center (CDC)

About the job

IT Security Analyst – Cyber Defence Center (CDC)

Responsibilities

As an IT Security Analyst in the Cyber Defence Center, you monitor and analyse security-relevant events from various sources, conduct in-depth analyses, and initiate appropriate protection and countermeasures when necessary.
Your tasks include in particular:

• Analysis, triage, and handling of security alerts and incidents from SIEM, Microsoft Defender XDR, endpoint, network, identity, cloud, and other security sources
• Conducting in-depth analyses and threat hunting in the Microsoft Defender portal, especially using Advanced Hunting and KQL or other tools in our SIEM
• Correlation and evaluation of events across different systems, log sources, and security products
• Investigation of suspicious activities, attack indicators, and possible compromises as well as initiation of appropriate incident response measures
• Blocking and managing indicators of compromise (IOC) such as IP addresses, domains, URLs, or hashes, etc.
• Further development of detection, hunting, and response use cases in the SIEM as well as within the Microsoft 365 and Defender security platform
• Development and optimisation of KQL queries, detection rules, alerting logics, and automations
• Collaboration in vulnerability management, especially in the assessment, prioritisation, and follow-up of identified vulnerabilities
• Continuous improvement of our security monitoring, detection, and response processes in the CDC
• Documentation of incidents, analyses, and measures as well as collaboration in IT security reporting

Profile

For this demanding position, we are looking for an analytically strong, independent, and trustworthy individual with enthusiasm for technical security analysis, threat hunting, and incident response.
You bring with you:

• A completed degree, vocational baccalaureate, or higher education in computer science, cyber security, or a comparable qualification
• Practical professional experience in security operations, SOC, CDC, incident response, or IT security
• Very good knowledge of SIEM systems, security logs, and detection use cases
• Good knowledge of the Microsoft security platform, especially Microsoft Defender XDR, Defender for Endpoint, Microsoft 365 Security, and Advanced Hunting
• Practical experience with KQL (Kusto Query Language) for analysing, correlating, and detecting security-relevant events
• Experience in exposure management, including vulnerability management
• Sound knowledge in the areas of network, endpoint security, identity, and cloud security as well as common attack and detection methods
• Experience in analysing and handling indicators of compromise (IOC) and security incidents
• Scripting skills, for example in PowerShell, Python, or Bash, are an advantage
• Structured, precise, and efficient working style as well as good analytical and communication skills
• Good German and English language skills

We offer

Our employees benefit from diverse and attractive offers. Learn more at: https://www.uzh.ch/de/explore/work.html.

Workplace

Central IT

Application information

Further information

Questions about the position

Sacha Schweizer
Head of Cyber Defence Center
+41 44 634 00 91
sacha.schweizer@uzh.ch

Working at UZH

As the largest university in Switzerland, the University of Zurich offers a variety of attractive positions in different academic fields and professional areas. With around 10,000 employees and currently 12 vocational profiles for apprentices, the university provides an inspiring working environment in cutting-edge research and education. Put your talent and skills to use with us. Learn more about UZH as an employer!