Job
In this role, you will develop new use cases for security monitoring, conduct threat analyses, and ensure attack detection through hands-on validation and automation utilizing AI.
This listing has been machine translated. Show original
Job technologies
Your role in the team
- Enhance threat intelligence by leveraging technology and information available from both internal and external sources.
- Perform threat management and threat modeling, identify threat vectors, and develop use cases for security monitoring.
- Analyze and assess damage to data and infrastructure resulting from security incidents, examine available recovery tools and processes, and recommend solutions.
- Validate and tune your own detection use cases by safely reproducing attacker techniques in our lab environment—we expect you to know what your rules look like when they fire.
- Take part in purple team exercises with our Adversary Simulation colleagues and turn observed attack behavior into reliable detection logic.
- Review the results of automated attack simulation runs and translate detection coverage gaps into concrete tuning and engineering tasks.
- You will work with AI-assisted triage, hunting, and reporting from day one, and your feedback on where it helps—and where it is confidently wrong—will directly shape how we build it.
- You will help develop detection coverage for the bank's own AI adoption: our monitoring scope now includes AI and LLM workloads, not just traditional infrastructure.
- We would rather you automate your repetitive work than do it twice - contributions to detection-as-code and SOAR playbook development are explicitly part of the role.
Our expectations of you
Qualifications
- Strong understanding of the MITRE ATT&CK framework, the Cyber Kill Chain, and other attack models.
- Practical understanding of how common attack techniques are executed—we value analysts who can reproduce a technique in a lab and recognize the traces it leaves in telemetry, rather than knowing it only from a framework.
- Ability to write Python or PowerShell scripts to automate tasks, enrich security data, and validate detections.
- Familiarity with common offensive tools (e.g. BloodHound, Impacket, Mimikatz and C2 frameworks) and the forensic artefacts they leave behind is an asset.
- Awareness of security risks associated with AI and LLMs, such as prompt injection and data leakage, and familiarity with the OWASP Top 10 for LLM Applications are assets.
- Vendor-independent security certifications (e.g., CISA, CRISC, CISSP, or CEH) are an asset.
Experience
- Hands-on experience in security monitoring and incident detection within a Security Operations Center.
- Hands-on experience configuring, maintaining, and improving SIEM platforms.
- Practical experience using LLM-based tools in your daily work, including effective prompting, recognizing unreliable output, and verifying results before acting on them.
- Experience running ATT&CK-aligned tests using tools such as Atomic Red Team or Caldera, or working with breach and attack simulation platforms, is an asset.
- Experience working with cyber threat intelligence (CTI) platforms is an asset.
- A hands-on offensive security certification (e.g., OSCP or GPEN), or equivalent experience with advanced labs such as Hack The Box Pro Labs, is a welcome addition—but this is a defensive role, not a full-time penetration testing position.
What we offer
- Work-life balance: Flexible working hours and work-from-home options from Austria.
- Career growth: We believe in continuous learning and proactive career development.
- Take on challenging work that stretches your abilities, attend training sessions, and use new technologies to make a lasting impact.
- Stay healthy: Subsidized canteen, well-being programs, check-ups, and sports allowances.
- Save money: Discounts, exclusive banking terms, and a free public transport pass.
- Family support: Child allowances, gender-neutral parental leave, a bilingual company kindergarten, and holiday childcare.
Benefits
Health, fitness & fun
Work-Life-Integration
Higher take-home pay
Food & drink
Topics you will work on
Job locations
About your employer
The Raiffeisen Bank International AG (RBI) is a leading commercial and investment bank in Austria and also considers Central and Eastern Europe (CEE) to be its home market. In CEE, the RBI has a tightly knit network of subsidiaries, leasing companies, and a variety of specialized financial service providers in 17 markets.
- 250+ Employees
- 2010
- English
- Established Company
- Onsite, Hybrid, Full Remote
- Banking, Finance, Insurance
Employer reviews
- Career growth
- 4.0
- Team culture
- 4.4
- Working conditions
- 4.7
- Engineering
- 3.6
More jobs
These jobs might also interest you
End-to-End Development:You accompany exciting software projects from the initial requirements analysis through implementation (e.g., with Spring Boot) to successful deployment. Microservices & Architecture:You design and develop robust, highly scalable...
We are a modern IT service company and support corporate clients across all areas of IT infrastructure – from workstation systems and servers to networks, firewalls, and cloud solutions. To expand our team, we are looking for one IT Technician / IT...
We are one of the leading European manufacturers of innovative biomass heating systems (firewood, wood chips, pellets). Due to the strong demand for our products and the excellent future prospects for "renewable energy," we are expanding our team. ...
