Senior Cybersecurity Researcher

We are seeking a senior security engineer to join our global Cyber Defense Center (CDC) Engineering team. You will apply an Everything-as-Code approach to build and manage our software-defined security operations architecture, designing the logic and systems that power our global detection and response platform.

Key Responsibilities:

•    Engineer Detection-as-Code: Write detection logic using KQL, SPL, SQL, and Python. Manage the lifecycle strictly through version control and CI/CD pipelines. Create new monitoring use cases based on red team exercises, CTIC reports, and your own hypothesis-driven threat research.
•    Automate Threat Response: Build and integrate modular automation playbooks across the security stack to accelerate incident response.
•    Deception Engineering: Architect and scale enterprise deception capabilities (canaries, honeytokens) to detect adversary activity across all stages of the attack lifecycle.
•    Optimize Security Controls: Configure and tune enterprise security controls (XDR, firewalls, cloud security, DLP) to adapt to new threats.
•    Drive Capability Engineering: Partner with cross-functional teams to translate analytical needs into architecture and working code. Ensure engineering output directly supports frontline defenders without adding operational friction.
•    Establish AI & Data Foundations: Integrate contextual data models (like knowledge graphs), API gateways, and threat intelligence pipelines to support our targeted AI and ML workloads.
•    Leverage Hybrid Data Ecosystems: Develop detection and automation use cases across a variety of different data architectures (SIEM, data lakes, S3/Storage blobs, Federated Search).
•    Mitigate Security Gaps: Mitigate detection and response gaps through the creation of new detection rules, improvement of processes, new architectural designs, and hand-over to other technical teams.
•    Enforce Pipeline Quality: Build and maintain CI/CD pipelines with automated validation gates for secure content deployment. Use breach attack simulation & threat intelligence verification where applicable in larger validation workflows.

Required Skills & Qualifications:

•    Collaboration & Articulation: Problem-solving mindset with the ability to bridge the gap between engineering and SOC operations effectively. Able to convey targeted messages to different audiences.
•    Core Security Expertise: Strong background in SOC and/or SecOps engineering.
•    Engineering Mindset: Proficiency in Python or PowerShell, software engineering best practices, APIs, and data structures (JSON/YAML).
•    Query Mastery & Scripting: Deep proficiency in security query languages (Splunk SPL, KQL, SQL) and Python/TypeScript.
•    GitOps & CI/CD: Hands-on experience with Git and CI/CD platforms for managing infrastructure and logic as code.
•    Security Tooling: Technical experience configuring and administering enterprise security controls (XDR/EDR/NDR, Firewalls, Cloud Security, DLP, Identity).
•    Active Defense: Deep expertise in adversary tactics and techniques to position deceptive assets along realistic attack paths without impacting production.

Good-to-Have Skills:

•    Data Modeling: Familiarity with Graph Databases (Neo4j, Cosmos DB Gremlin) and entity relationship modeling.
•    Applied AI: Experience integrating LLMs or building RAG pipelines for enterprise use cases.
•    Containerization & IaC: Experience with Docker, API Gateways, and Infrastructure-as-Code (Terraform/Bicep).
•    Software Development: Experience working with compiled languages (C# / .NET).
•    OT Security: Exposure to Operational Technology (OT) and manufacturing environments.

Union representatives for Swedish applicants: 
Akademikerna – Mikael Johansson, +46 73 9023430
Unionen – Lajla Dahlsjö, +46 31 3224575
Ledarna – Carina Sachade, +46 73 9024083

We value your data privacy and therefore do not accept applications via mail. 
 

“In some countries and for specific positions within Volvo Group Digital & IT, background checks may be required, in accordance with local laws & regulations. If this is applicable to the role you have applied for, you will be informed.”