Analyst - Global Cyber Defense Team GDCT

Celonis

Madrid, Spain

Full Time

Posted January 20, 2026

Not Specified

Apply Now

Application opens on company website

Job Description

A cybersecurity analyst responsible for monitoring, analyzing, and responding to security events and incidents across endpoints and cloud environments, supporting incident response activities, and helping to improve detection and response processes within a leading SaaS company's global security team.

Key Responsibilities

Monitor security events and potential incidents on user endpoints and cloud environments
Respond to security threats in accordance with policies and procedures
Participate in incident response activities, including initial analysis and documentation
Conduct shift handovers to ensure effective case management
Assist in developing detection, response processes, and IR playbooks
Create and test defense procedures and IR automation tools

Requirements

Fundamental knowledge of Cloud Platform Security, Log Analysis, DevSecOps, Endpoint Detection Response (EDR) Tooling, Security Information Event Management (SIEM) Tooling, Incident Response Frameworks, Incident Response Activities, Attack Frameworks, Endpoint Security, Container Security, Database Security, Email Security, Network Security, and Social Engineering Techniques.
Experience in monitoring security events and potential security incidents on user endpoints and within cloud native environments.
Ability to respond to security events and incidents in accordance with Celonis policies and procedures.
Participation in all pre and post incident activities as outlined in the Celonis Information Security Incident Response Plan.
Perform initial analysis of all new alerts generated by correlation alerting tools and other external sources feeding into the SIEM system and other security monitoring tools.
Respond to potential security threats to the organization.
Document relevant incident information into the case management system, detailing critical data for each incident to develop a historical record.
Assist in the development of processes and procedures to improve detection and response capabilities.
Create and test Celonis Defense Procedures and Incident Response (IR) Playbooks.
Create Detection Use Cases.
Assist with building IR automations.
Participate in weekly afterhours on-call rotation.
Shift coverage includes monitoring of user endpoints, cloud native environments, SIEM, and other internal security tools.
Possess fundamental knowledge of incident response activities, attack frameworks, and endpoint security.
Ability to analyze security logs and alerts from various security tools.
Experience with creating and testing IR procedures and automations.
Knowledge of security frameworks and attack methodologies relevant to incident response.