Senior Security Analyst

SIEM Lead in the Cyber Defense team

As SIEM Lead, you will be the owner of our SIEM application (Splunk Enterprise Security) used by TDC NET’s Cyber Defense team. Your work will help analysts detect and investigate threats across our IT systems and Denmark’s critical telecommunications infrastructure.

About the job

Your focus will be the SIEM application, its detections and the workflows analysts use every day. A dedicated engineering team in another department operates the underlying platform. You will work with that team on security data requirements and with the Head of Analysts to prioritize improvements.

Our work is guided by threat intelligence. The wider Cyber Defense team covers detection and response, threat hunting, detection engineering, incident response and forensics, penetration testing and red teaming, vulnerability management, anti-abuse and security postmaster services.

Your responsibilities

• Own the SIEM application for the Cyber Defense team, defining its roadmap and priorities with the Head of Analysts and coordinating delivery with the engineering team.
• Assess gaps in SIEM capabilities, data coverage and investigation workflows, and turn findings into a prioritized improvement plan. Track progress through measures of coverage and alert quality.
• Maintain investigation dashboards, reusable searches and security context, including threat intelligence and asset and identity information used to enrich alerts.
• Define logging and data requirements for the engineering team. Validate that delivered data contains the fields, timestamps and context needed for detection and investigation.
• Act as the technical lead for SIEM analysis during major incidents, coordinating with incident response colleagues.
• Mentor analysts in SIEM use, alert analysis and investigation techniques, and review detection content and tuning decisions with the team.
• Validate detections with the Security Testing team through attack simulations and purple team exercises and follow up on missed or incomplete alerts.
• Our Cyber Defense team is Trusted Introducer certified, and our Security Testing team is CREST certified.
• You will join approximately 45 colleagues in TDC NET Security, with an open, informal working culture where people share knowledge and challenge ideas.
• The Cyber Defense team operates a 24/7 on-call rotation. As Senior Security Analyst, you will participate in this rotation, investigating and responding to security incidents outside normal working hours.

About you

You are an experienced (3-5+ years of experience) security analyst with solid practical SIEM knowledge and the ability to turn operational needs into clear priorities. You can make sound decisions with incomplete information, coordinate technical analysis under pressure and communicate findings and uncertainty clearly to both technical and non-technical colleagues.

We are looking for experience in the following areas

• Working with SIEM capabilities, data flows, integrations and application configuration in a production SOC or Cyber Defense environment.
• Taking ownership of a SIEM application, assessing gaps and defining a practical, prioritized roadmap in collaboration with analysts and platform engineers.
• Investigating incidents and hunting for threats using endpoint, identity, network and application logs, with an understanding of data quality and normalization.
• Using threat intelligence and MITRE ATT&CK to define detection requirements and identify gaps in coverage.
• Translating security needs into clear requirements for engineers and providing practical guidance to less experienced analysts.
• Understanding offensive techniques such as exploitation, privilege escalation and lateral movement, and the evidence they leave in logs.
• Using penetration tests, red team findings or purple team exercises to validate detections and close monitoring gaps.
• You must be able to maintain security clearance at HEMMELIGT (SECRET) level throughout your employment.
• Experience with scripting, automation and version control is welcome.
• Relevant higher education and security certifications are also welcome.

Contact

• If you have questions about the position or want to know more
• about what it means to work at TDC NET, feel free to reach out to Cyber Defense Director Cristiano Iria at [email protected]
• We look forward to reviewing your application and potentially welcoming you to our team at TDC NET.

Location

Teglholmsgade 1, Købehavn or Sletvej 30, Aarhus

Process

Submit your application - including your CV and a cover letter.

We are inviting candidates for interviews on an ongoing basis. However, with the upcoming holiday period, please expect the recruitment process to continue into January 2027.

Please apply as soon as possible and no later than 30 November 2026.

You can expect to hear from us within 3 weeks from the application date.

Click here to read more about TDC NET and how it is to work at us.

You apply via ”Apply now” in the top left corner.

We encourage you not to include a photo in your CV or cover letter. In TDC NET we are dedicated to fostering an inclusive culture that values diversity, and we pride ourselves on providing equal opportunities for everyone. All qualified candidates will be assessed regardless of ethnicity, religion, gender, gender identity, sexual orientation, disability and all the other characteristics that make us different.

We are looking forward hearing from you!

TDC NET - lots of benefits

Engage in meaningful work

The green transition needs a strong digital infrastructure. With us

you will take part in delivering the technological solutions.

For

all of us.

We provide the working life of the future

We

• set targets for a healthy and safe working environment.
• Our work culture is digital and flexible when compatible with tasks
• and colleagues.
• Welcome to your new hybrid workplace.
• Development through challenges - get lots of responsibility
• from day one
• Get responsibility quickly and be a part of the biggest transformation in our field - ever.

Be

challenged.

Become part of a strong network

Take

part in connecting Denmark together with both new and experienced

colleagues and many various professional competencies.

In

TDC NET we are both motivated and united by a strong network.

Our values

#LI-POST #TDCNET