Threat Engineering Lead

Take a step forward and let Edenred surprise you.

Every day we deliver innovative solutions to improve the life of millions of people connecting employees companies and merchants all around the world.

We know there are hundred ways for you to grow. With us you will expand your skills in a multicultural challenging and dynamic environment.

Dare to join Edenred and get ready to thrive in a globalcompany that will offer you endless opportunities.

Edenred is all about meritocracy. You come as you are and you contribute. Indeed the Edenred Group recognizes recruits and develops all talents and singularities.

We are committed to preventing all forms of discrimination and to providing all our candidates with equal opportunities regardless of their gender and gender expression disability origin religious belief and sexual orientation or any other criteria.

ABOUT EDENRED

Edenred is a pioneer a tech leader and the everyday companion for people at work across 44 countries.

Our 12000 employees are committed to making the world of work a better place for all one that is safer more efficient and more user-friendly. At Edenred our passion for customers respect imagination simplicity and entrepreneurial spirit are our values. For anyone who needs to vibe in their professional life we are the best place for you to work and grow.

The Edenred Digital Center (EDC) in Bucharest Romania is Edenred Groups new Digital hub for strategic IT projects.

Context/ROLE

The Threat Engineer Lead is responsible for transforming internal and external threat intelligence into actionable detection capabilities threat hunting programs automated response workflows and AI-driven security operations improvements.

A senior individual-contributor role owning the evolution of Edenreds threat hunting detection and response capabilities. The position focuses on proactively identifying threats engineering scalable and high-fidelity detections and continuously improving incident response outcomes across Edenreds security ecosystem. By applying AI/ML selectively and pragmatically to detection triage and investigation workflows the role drives greater speed precision and operational effectiveness while ensuring robust validation and governance. This is a highly technical leadership role with enterprise-wide influence and no people management responsibilities. The role serves as the critical bridge between Cyber Threat Intelligence (CTI) CSIRT detection Engineering and security Automation. The successful candidate will design and implement processes technologies and operating models that enable proactive identification detection and response to emerging cyber threats.

Position SCOPE & Key Responsibilities

Threat Engineering Lead - Threat Hunting Detection & Response will:

• Identify opportunities to automate threat intelligence processing triage investigation and response activities
• Own the detection data pipeline and a reference architecture; threat-model current and new systems; evaluate and select tooling; align to MITRE ATT&CK NIST CSF and ISO 27001 (PCI DSS / DORA where applicable) and report coverage
• Implement detection engineering test and maintain detections as code; own the false-positive / false-negative lifecycle; map coverage to ATT&CK; favor behavior-based detections; report detection-quality metrics
• AI / ML for threat detection & response - accelerate authoring and translation behind an automated validation harness; automate alert triage and enrichment; apply ML to support anomaly-driven threat hunting and behavioral baselining; always human-in-the-loop never an unchecked decision-maker
• Partner closely with CTI providers SOC analysts incident managers and security engineering teams to transform threat intelligence incident learnings and emerging threat indicators into enterprise detection and response capabilities
• Lead the development of threat hunting campaigns detection use cases behavioral analytics automated response workflows and security architecture improvements
• Validate outcomes through threat emulation coverage assessment detection quality metrics and operational response effectiveness.

Required skills & profile

Experience

• 8 years across detection engineering threat hunting and incident response owning detection content end-to-end
• Splunk experience EDR experience (CrowdStrike Defender TrendMicro) Zscaler experience Azure experience AWS experience
• Detection-as-code practice: version control testing and CI; able to defend detection quality with metrics
• Strong automation in Python (a plus); production security tooling and API integrations
• Demonstrated application of AI/ML to security workflows with a discipline of validating outputs before production
• MITRE ATT&CK fluency; Windows / Linux / macOS and M365 / Azure / AWS security; security architecture and threat-modelling ability
• Engineering discipline applied to detection code review testing measurable outcomes; AI as an accelerator under human oversight
• Collaborative mindset with the ability to work effectively across SOC engineering infrastructure cloud and business teams
• Demonstrated ability to communicate security risks detection gaps and architectural recommendations to both technical and non-technical stakeholders
• Ability to effectively communicate investigation findings threat assessments and response recommendations during active incidents
• Proven ability to facilitate discussions challenge assumptions constructively and build consensus on security decisions
• Excellent written communication skills including architecture documentation technical standards detection specifications and executive-ready reporting
• Strong mentoring and knowledge-sharing mindset helping elevate the technical capabilities of analysts engineers and security practitioners
• Calm structured and decisive approach during security incidents and crisis situations

Nice to have:

• GIAC/CISSP/Azure Security; purple teaming (Atomic Red Team Caldera); email security (DMARC/BEC); ZTNA/SASE/DLP; payments-reg exposure (PCI DSS/DORA)
• Experience implementing AI-assisted SOC capabilities
• Experience with Detection-as-Code frameworks
• Experience with security telemetry engineering
• Experience building enterprise-wide threat hunting programs
• Experience in global enterprise environments

Languages:

• Mandatory: Proficient level of English (spoken and written)

VIBE WITH US

Joining us means:

• Becoming part of a team that embraced the digitalization challenge and enjoys this transformation every day
• Living our values every day: passions for customers respect imagination simplicity entrepreneurial spirit.

Because:

• You will get exposure to various global cultures and teams
• You will be working with the newest technologies to build a new platform from scratch
• We offer you a very pleasant working environment close to Bucharest city center
• We also have for you: meal tickets holiday vouchers health subscription flexible hours work from home flexible benefits system on-the-job training & e-learning platforms.

And we do not stop here!

Apply now and Vibe with Us!