Cyber Defence Engineer - Incident Response

About the role

Vodafone is looking for a Cyber Defence Engineer specialized in Incident Response. You will work with a global security team to detect, analyse and remediate cyber threats across a wide range of assets, ensuring compliance with standards such as PCI‑DSS, ISO27001, GDPR and SOX.

Key responsibilities

• Continuously review logs from Active Directory, databases, applications, network devices, operating systems and user behaviour.
• Detect, investigate and respond to known and unknown threats using EDR, NDR, SIEM, SOAR and UEBA tools.
• Develop and maintain detection rules, playbooks and content for SIEM and SOAR platforms.
• Integrate threat‑intelligence feeds and conduct attack‑simulation exercises.
• Prepare evidence and reports for internal and external audits.
• Provide executive‑level and technical reporting on incident management activities.

Required profile

• BSc in Computer, Industrial, Electrical or Electronics Engineering (preferred) or equivalent experience.
• Master’s degree in Computer Science or Cyber Security is a plus.
• Minimum 6 years of hands‑on experience in information security and network administration.
• Experience working in complex operational ICT environments.
• Relevant certifications (e.g., Security+, ECIH, GCIH, GCIA, GCTI, GCFA, CCNA, CCNP, CISSP) are advantageous.

Required skills

• EDR, NDR, SOAR, UEBA, SIEM, sandboxing, malware forensics, threat hunting, vulnerability scanning.
• Strong knowledge of the MITRE ATT&CK framework.
• Python, Go, Bash or similar scripting languages.
• TCP/IP, routing, switching, network protocols, packet analysis.
• Windows, UNIX and Linux operating systems.
• Firewall, IDS/IPS, DLP, anti‑virus/anti‑malware solutions.
• Cloud computing and SaaS security concepts.