> Markdown version of [/jobs/ext/1938776-yourliebherrcareer-security-monitoring-incident-response-product-owner](https://www.wearedevelopers.com/jobs/ext/1938776-yourliebherrcareer-security-monitoring-incident-response-product-owner). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Yourliebherrcareer: Security Monitoring & Incident Response Product Owner - **Company:** Liebherr - **Location:** Madrid, Spain - **Contract:** Permanent contract - **Skills:** Cyber Security, Mitre Att&ck, Information Technology, Cybercrime - **Published:** August 5, 2026 - **Apply:** https://www.buscojobs.com.es/yourliebherrcareer-security-monitoring-incident-response-product-owner-m-f-d-en-madrid-ID-366077929 ## About the Role Bachelor's/Master's in Cybersecurity, Computer Science, or related field. 7+ years of operational experience in SOC environments (L2/L3, threat hunting, incident response, service delivery, operational delivery). Exposure to global organizations and distributed security functions. Knowledge of modern security frameworks (MITRE ATT&CK, NIST CSF, ISO *****). Experience implementing KPIs and running continual service improvement processes. Relevant certifications (e.g., CISSP, GCIH, CCSP, GCIA, GMON) are a plus, but not mandatory. Fluency in English (written and spoken). Willingness and ability to travel to Liebherr sites worldwide up to 10% of the time. ## Description We are expanding our Global Corporate Information Security team and are looking for aSecurity Monitoring & Incident Response Product Owner (m/f/d)to establish and scale our global security operations.The Security Monitoring & Incident Response Product Owner is responsible for driving the operational excellence, implementing the strategic evolution, and service quality of our global Security Operations Center (SOC). The Security Monitoring & Incident Response Product Owner serves as the central orchestrator between internal SOC team members, the MSSP, technology teams, and the Head of Global SOC - ensuring that the SOC delivers reliable, high quality security monitoring and continuously improves its maturity, coverage, and effectiveness.The working location for this position will be in Madrid city, where we operate a hybrid model, requiring at least 40% of the working time on-site.Creating passion: your responsibilitiesSOC Operations & Service ManagementOwn the end-to-end operations of the global SOC, ensuring effective collaboration between internal analysts and the MSSP (L1/L2).Monitor, manage, and optimize processes, including alert triage, escalation flows, and incident response handovers.Ensure all services related to Security Monitoring and Incident Response to perform against defined SLAs and KPIs, and drive actions when service quality deviates.Implement the SOC "product" roadmap related to Security Monitoring & Incident Response, including implementation of the strategic vision, backlog, and prioritization of improvements.Vendor & MSSP ManagementAct as the primary liaison between the organization and the MSSP to deliver SOC services.Conduct recurring service governance meetings (operational and tactical).Track and validate MSSP deliverables, including detection operations, case handling quality, and runbook adherence.Coordinate improvements to MSSP workflows, communication channels, and response processes.Incident Response AlignmentAlign with the internal incident response team to ensure seamless escalation.Support the refinement of incident response procedures, playbooks, and communication guidelines.Ensure major incidents are appropriately handled, documented, and followed by lessons learned sessions.Guide the continuous evolution of incident management maturity and readiness.Governance, Compliance & DocumentationMaintain alignment with internal security frameworks, standards, and regulatory requirements.Produce regular reports on operational performance, risks, coverage, and incident trends.Ensure processes, runbooks, service definitions, and operating procedures are consistently documented and kept up to date.Support audits, assessments, and readiness activities related to detection and response.Contributing your strengths: your qualificationsBachelor's/Master's in Cybersecurity, Computer Science, or related field.7+ years of operational experience in SOC environments (L2/L3, threat hunting, incident response, service delivery, operational delivery).Exposure to global organizations and distributed security functions.Knowledge of modern security frameworks (MITRE ATT&CK, NIST CSF, ISO *****).Experience implementing KPIs and running continual service improvement processes.Relevant certifications (e.g., CISSP, GCIH, CCSP, GCIA, GMON) are a plus, but not mandatory.Fluency in English (written and spoken).Willingness and ability to travel to Liebherr sites worldwide up to 10% of the time.Our commitment to you: your benefitsAt Liebherr, we believe people are at the heart of our success. As part of our international team, you'll enjoy a secure role in a family-owned company that values innovation, collaboration, and long-term career growth:Competitive compensation and benefits package that recognizes your expertise.Flexible and hybrid working model.Creative freedom and responsibility to shape processes and solutions in our global transformation.Continuous learning and development with tailored training and certification opportunities.Meal vouchers.Life and accident insurance.Option to include a premium private health insurance package as part of the flexible remuneration.A safe, stable and international workplace within a trusted family business that invests in people.Please only use the online application option.Please note that we do not accept applications via recruitment agencies for this position.Have we awoken your interest? Then we look forward to receiving your online application. If you have any questions, please contact Karoliina Rissanen.One Passion. Many Opportunities.The companyLiebherr is a family-run technology company that is not only one of the largest construction machinery manufacturers in the world, but also offers high-quality, user-oriented products and services in many other areas. The Group employs nearly 50,000 people in more than 140 companies on all continents.LocationLiebherr IT Shared Service Centre Ibérica, S.L.Parque Norte. Alamo building Serrano Galvache, 56*****MadridSpain (ES)ContactKaroliina Rissanen******[Not translated in selected language] ## Related Videos - [What makes Cybersecurity different for critical infrastructure?](https://www.wearedevelopers.com/videos/571-what-makes-cybersecurity-different-for-critical-infrastructure) - [Fighting the Next Wave of Cybercrime](https://www.wearedevelopers.com/videos/100331-fighting-the-next-wave-of-cybercrime) - [Thinking Differently - How to Make Money from Cyber Attacks & Cheats](https://www.wearedevelopers.com/videos/745-thinking-differently-how-to-make-money-from-cyber-attacks-cheats) - [Cyber Security: Small, and Large!](https://www.wearedevelopers.com/videos/259-cyber-security-small-and-large) - [Security Pitfalls for Software Engineers](https://www.wearedevelopers.com/videos/726-security-pitfalls-for-software-engineers) - [Deep Fakes: The Lies We Can’t See](https://www.wearedevelopers.com/videos/1187-deep-fakes-the-lies-we-can-t-see) ## Related Articles - [9 Ways to Make Money Hacking](https://www.wearedevelopers.com/magazine/333-9-ways-to-make-money-hacking) - [Finding IT & Technology English-speaking Jobs in Germany ](https://www.wearedevelopers.com/magazine/446-finding-it-technology-english-speaking-jobs-in-germany) - [The Most Popular IT Jobs on the Market](https://www.wearedevelopers.com/magazine/376-the-most-popular-it-jobs-on-the-market) - [Finding Jobs in Germany](https://www.wearedevelopers.com/magazine/375-finding-jobs-in-germany) - [IT Salaries in Germany](https://www.wearedevelopers.com/magazine/287-it-salaries-in-germany) - [System change: restart as developer?](https://www.wearedevelopers.com/magazine/39-system-change-restart-as-developer)