> Markdown version of [/jobs/ext/3976960-cyber-defense-specialist](https://www.wearedevelopers.com/jobs/ext/3976960-cyber-defense-specialist). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Cyber Defense Specialist - **Company:** Raiffeisen Bank International AG - **Location:** Austria - **Salary:** €47,256.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Software System Penetration Testing, Cyber Security, Computer Telephony Integration, Information Leak Prevention, Python (Programming Language), Open Web Application Security, Windows PowerShell, Red Team (Cyber Security), Security Information and Event Management, Large Language Models, Mitre Att&ck, Purple Team (Cyber Security), Cyber Warfare - **Published:** October 28, 2026 - **Apply:** https://jobs.rbinternational.com/talentcommunity/apply/1362678557/?locale=de_DE ## About the Role * Hands-on experience in security monitoring and incident detection within a Security Operations Center * Strong understanding of the MITRE ATT&CK framework, the Cyber Kill Chain and other attack models * Hands-on experience configuring, maintaining and improving SIEM platforms * Practical understanding of how common attack techniques are executed - we value analysts who can reproduce a technique in a lab and recognize the traces it leaves in telemetry, rather than knowing it only from a framework * Ability to write Python or PowerShell scripts to automate tasks, enrich security data and validate detections * Practical experience using LLM-based tools in your daily work, including effective prompting, recognizing unreliable output and verifying results before acting on them * Familiarity with common offensive tools (e.g. BloodHound, Impacket, Mimikatz and C2 frameworks) and the forensic artefacts they leave behind is an asset * Experience running ATT&CK-aligned tests using tools such as Atomic Red Team or Caldera, or working with breach and attack simulation platforms, is an asset * Experience working with cyber threat intelligence (CTI) platforms is an asset * Awareness of security risks associated with AI and LLMs, such as prompt injection and data leakage, and familiarity with the OWASP Top 10 for LLM Applications are assets * Vendor-independent security certifications (e.g. CISA, CRISC, CISSP or CEH) are an asset * A hands-on offensive security certification (e.g. OSCP or GPEN), or equivalent experience with advanced labs such as Hack The Box Pro Labs, is a welcome addition - but this is a defensive role, not a full-time penetration testing position ## Description As a crucial part of Raiffeisen Bank International's Group Cyber Defense Center, this function develops detection and prevention mechanisms to support our digitalization journey and maintain our customers' confidence. In this position, you will be a member of our Group SOC team. This includes providing effective security monitoring through triage, investigation, communication and reporting. You will be encouraged to conduct your own threat hunting investigations, create and refine detection use cases, and build tactical and strategic mitigation plans that measurably improve our security posture. You will work together with IT and security engineers to onboard bank products and build the cyber security use cases needed to protect them. You will also work hands-on with the AI-assisted and semi-autonomous tooling we are introducing across the SOC, and your judgement will shape how far we take it. What you can expect: * Enhance threat intelligence by leveraging technology and information available from both internal and external sources * Perform threat management and threat modelling, identify threat vectors, and develop use cases for security monitoring * Analyze and assess damage to data and infrastructure resulting from security incidents, examine available recovery tools and processes, and recommend solutions * Validate and tune your own detection use cases by safely reproducing attacker techniques in our lab environment - we expect you to know what your rules look like when they fire * Take part in purple team exercises with our Adversary Simulation colleagues and turn observed attack behavior into reliable detection logic * Review the results of automated attack simulation runs and translate detection coverage gaps into concrete tuning and engineering tasks Where we are going with AI: RBI has its own AI strategy, and we are deliberately building towards an agentic SOC: analysts supported by semi-autonomous processes covering enrichment, correlation, use-case quality assurance, threat hunting support and reporting. We are hiring people who want to shape that, not watch it happen. * You will work with AI-assisted triage, hunting and reporting from day one, and your feedback on where it helps - and where it is confidently wrong - will directly steer how we build it * You will help develop detection coverage for the bank's own AI adoption: our monitoring scope now includes AI and LLM workloads, not just traditional infrastructure * We would rather you automate your repetitive work than do it twice - contributions to detection-as-code and SOAR playbook development are explicitly part of the role ## About Raiffeisen Bank International AG **Did you know that RBI is one of the most popular domestic employers?**   Sure: it is also one of the **leading banking groups** in Austria and CEE. RBI not only shines on the outside, it also has inner values. The banking landscape is changing, as is RBI. **Cross-functional** teams, quick exchange of knowledge, independent work and **creativity** are very important. This is the only way for the bank to bring products and services onto the market in this fast-moving time that bring... **Tech Stack:** Java, Jenkins, Angular, JavaScript, Python, Kubernetes, Docker, REST, Agile Methodologies, Grafana, Apache, Go, Cloud (AWS/Google/Azure) , Data analysis, DevOps, Microservices **Industries:** Cloud Computing, Enterprise Software, Finance/Insurance, Computer Software [Company profile](https://www.wearedevelopers.com/companies/2938-raiffeisen-bank-international-ag) ### More Jobs at Raiffeisen Bank International AG - [Full Stack Engineer](https://www.wearedevelopers.com/jobs/ext/3976999-full-stack-engineer) - [Frontend Developer](https://www.wearedevelopers.com/jobs/ext/3854438-frontend-developer) - [Software Engineer mit AI-Expertise](https://www.wearedevelopers.com/jobs/ext/3763096-software-engineer-mit-ai-expertise) - [Backend Developer](https://www.wearedevelopers.com/jobs/ext/3081013-backend-developer) - [SAP S/4HANA Application Manager](https://www.wearedevelopers.com/jobs/ext/3081073-sap-s-4hana-application-manager)