IT Security Analyst – Cyber Defense Center (CDC)

Zentrale Informatik provides IT services for students, researchers, institutes, faculties, and central services of the Universität Zürich.
For our Cyber Defense Center (CDC), we are looking for a dedicated IT Security Analyst to strengthen our operational cyber security and actively help shape the detection, analysis, and processing of security incidents as well as the further development of our detection and response capabilities.

IT Security Analyst – Cyber Defense Center (CDC)

Tasks

As an IT Security Analyst in the Cyber Defense Center, you monitor and analyze security-relevant events from various sources, conduct in-depth analyses, and initiate appropriate protective and counter-measures if necessary.
Your tasks specifically include:

• Analysis, triage, and processing of security alerts and incidents from SIEM, Microsoft Defender XDR, endpoint, network, identity, cloud, and other security sources
• Conducting in-depth analyses and threat hunting in the Microsoft Defender portal, particularly using Advanced Hunting and KQL or other tools in our SIEM
• Correlation and evaluation of events across different systems, log sources, and security products
• Investigation of suspicious activities, attack indicators, and possible compromises, as well as initiation of appropriate incident response measures
• Blocking and managing Indicators of Compromise (IOC) such as IP addresses, domains, URLs, or hashes, etc.
• Further development of detection, hunting, and response use cases in the SIEM as well as within the Microsoft 365 and Defender security platform
• Development and optimization of KQL queries, detection rules, alerting logic, and automations
• Participation in vulnerability management, particularly in the assessment, prioritization, and follow-up of identified vulnerabilities
• Continuous further development of our security monitoring, detection, and response processes in the CDC
• Documentation of incidents, analyses, and measures, as well as participation in IT security reporting

Profile

For this demanding position, we are looking for an analytically strong, independent, and trustworthy personality with enjoyment in technical security analysis, threat hunting, and incident response.
You bring with you:

• Completed studies, vocational baccalaureate, or higher education in the field of informatics, cyber security, or a comparable qualification
• Practical professional experience in the area of security operations, SOC, CDC, incident response, or IT security
• Very good knowledge of handling SIEM systems, security logs, and detection use cases
• Good knowledge of the Microsoft security platform, especially Microsoft Defender XDR, Defender for Endpoint, Microsoft 365 Security, and Advanced Hunting
• Practical experience with KQL (Kusto Query Language) for the analysis, correlation, and detection of security-relevant events
• Experience in exposure management, including vulnerability management
• Sound knowledge in the areas of network, endpoint security, identity, and cloud security, as well as common attack and detection methods
• Experience in the analysis and processing of Indicators of Compromise (IOC) and security incidents
• Scripting knowledge, for example in PowerShell, Python, or Bash, is an advantage
• Structured, exact, and efficient way of working, as well as good analytical and communicative skills
• Good German and English skills

We offer

Our employees benefit from diverse and attractive offers. Learn more at:

Work location

Zentrale Informatik

Information on application

Further information

Questions about the position

Sacha Schweizer
Head of Cyber Defence Center

Working at the UZH

As the largest university in Switzerland, the Universität Zürich offers a variety of attractive positions in various subject areas and professional fields. With around 10,000 employees and currently 12 professional profiles for trainees, the university offers an inspiring working environment in cutting-edge research and education. Use your talent and your skills with us. Learn more about the UZH as an employer!

j4id10431061jm j4it1041jm j4iy26jm