Security Operations Engineer

Why Join Us? We’re on a mission to empower people with disabilities to do what they once did or never thought possible. As the world-leader in assistive communication solutions, we empower our customers to express themselves, connect with the world, and live richer lives. At Tobii Dynavox, you can grow your career within a dynamic, global company that has a clear, impactful purpose - with the flexibility to also do what truly matters to you outside of work. What’s more, you’ll be part of a work culture where collaboration is the norm and individuality is welcomed. As a member of our team, you’ll have the power to grow ideas in an unconventional environment. At the same time, you’ll work in a culture of ongoing learning and development, allowing you to constantly expand your area of expertise. Summer Holiday Notice Our team will be taking a summer break, and as a result, the recruitment process will move at a slower pace during this period. We will begin reviewing applications in the second half of August and will get back to candidates thereafter. Thank you for your patience, and we look forward to receiving your application! About the role We are looking for a Security Operations Engineer to join our global IT Operations team. As part of IT Operations, you will take ownership of operational security processes and controls. Ensuring our environment is secure, stable, and aligned with ISO27001 requirements. You will work hands on with implementing, monitoring and continuously improving security controls across endpoints, identity, network and Microsoft 365. Key responsibilities Security Operations Implement and continuously improve security controls across the IT environment Make sure logging, monitoring, and detection actually work in practice Investigate and respond to security incidents in collaboration with the Information Security team Security Processes Own and operate core IT-operations security processes, including: Access management (joiner / mover / leaver) Vulnerability and patch management Security validation in change processes Secure configuration baselines Keep these processes practical, measurable, and continuously improving over time Platform Security (Endpoint, Identity & Cloud) Manage and improve security across endpoints, identity, and cloud platforms Enforce secure configurations using tools such as Intune, Defender, and Entra ID Implement and maintain controls such as MFA, Conditional Access, and least privilege access Support secure lifecycle management of devices and identities Compliance & Audit support Ensure security controls align with ISO27001 requirements and work in practice Own technical audit readiness and evidence for IT Operations Collaborate on risk assessments, gap analyses, and remediation activities Support internal and external audits from a technical perspective Required skills & experience Experience in security operations or security engineering in an enterprise environment Hands-on experience with Microsoft security tools (e.g., Defender, Intune, Entra ID, Microsoft 365, Azure) Good understanding of endpoint, identity, and cloud security Experience with incident handling, vulnerability management, and security monitoring Familiarity with ISO27001 or similar frameworks Ability to work independently and take ownership of security initiatives within IT Operations Who you are Structured and pragmatic, with a focus on solving problems in a practical way Proactive and willing to take ownership of tasks and improvements Comfortable working independently, while collaborating with others when needed Communicates clearly with both technical and non-technical stakeholders Calm and methodical when handling incidents and operational challenges Apply today! We believe in empowering individuals - including our own employees - to reach their full potential. So, if you want to change lives while growing your own career, we’d love to hear from you. Where we stand: We believe diversity not only enriches our workplace culture, but also gives us a strategic advantage. Working with people from a variety of backgrounds and perspectives helps us all become better communicators, better problem solvers, and better human beings. Our differences make us stronger. Tobii Dynavox values equality of opportunity, human dignity, and racial/ethnic and cultural diversity. Tobii Dynavox does not discriminate against individuals on the basis of race, color, sex, sexual orientation, gender identity, religion, disability, age, veteran status, ancestry, or national or ethnic origin. Equal Opportunity Employer/AA Women/Minorities/Veterans/Disabled

We’re a team of experts pushing the limits of what’s possible, united by our common goal to unlock true freedom through digital ownership, making technology accessible for all. We believe in a world where users, creators and enterprises manage their value with ownership and freedom. Our curiosity drives us to innovate, empowering individuals on a global scale. We believe change is constant and our team moves forward as one, with a culture of problem-solving where every employee is empowered and supported to challenge tradition and create solutions. Our mission is simple: to make self-custody accessible and give people the keys to their own financial futures. If you want to make a true impact, we want you to join us at Ledger. At Ledger, we’re proud to be the global platform for digital assets and Web3, with over 20% of the world’s crypto assets secured through our Ledger devices. With our headquarters in Paris, and offices in Vierzon, Grenoble, Montpellier, London, Portland, Geneva, Zurich and Central Singapore, we have a team of around 600 professionals developing a variety of products and services to enable individuals and companies to securely buy, store, swap, grow and manage crypto assets – including the Ledger hardware wallets line with more than 7.5 millions units already sold in 200 countries. The team You will join the Security Operations team, which is responsible for protecting Ledger’s corporate, cloud, SaaS, and data center environments. Its mission is to anticipate, detect, investigate, and respond to cyber threats—including monitoring, alert triage, incident response, detection, visibility, automation, exposure tracking, and continuous process improvement. This scope is distinct from that of the Donjon (product security): SecOps covers the operational security of internal environments, the cloud, endpoints, workloads, identities, and infrastructure. As a close-knit and experienced team—technically rigorous and committed to knowledge sharing—we are also continuously building the SOC itself: integrating new log sources, ensuring data quality, expanding detection coverage, and developing reliable dashboards and operational workflows. Our technical stack includes: * Splunk for SIEM, investigations, and dashboards; * CrowdStrike for EDR and endpoint/workload security; * Wiz for cloud security and exposure management; * Torq for SOAR and automation; * AWS, including modern environments such as EKS/Kubernetes; * An in-house, internally developed Agentic SOC for alert enrichment, correlation, investigation support, reporting, and automation. AI is at the heart of how we work: investing in AI applied to security is a strategic priority for Ledger this year. We’ve built our own in-house Agentic SOC, which autonomously investigates weak signals—the large volume of unreliable alerts that a human team couldn’t sort through manually—and enriches them, so our engineers can focus on what matters most and resolve incidents faster: high-quality detection, reduced noise, and accelerated investigations. What you’ll be doing: As a Senior Security Operations Engineer, you are at the heart of the SOC: you lead investigations from start to finish, manage the lifecycle of detections, dashboards, and automations, and continuously expand our visibility (cloud, endpoints, identities, SaaS, infrastructure). You work independently on complex issues, decide on the next steps - investigation, containment, remediation, or escalation - serve as a technical resource and point of escalation for more junior analysts (whose work you review and with whom you share your knowledge), and make a tangible contribution to improving our internal Agentic SOC. Operate the SOC * Analyze, classify, and prioritize alerts (from Splunk, CrowdStrike, Wiz, AWS, and other sources), and conduct in-depth investigations into incidents affecting endpoints, the cloud, identities, SaaS, workloads, and infrastructure. * Provide clear, actionable context to inform next steps, and serve as an escalation point for less experienced analysts. * Leverage the Agentic SOC, which investigates weak signals and enriches alerts, so you can focus your time on the incidents that matter. Visibility & Detection * Build and tune cloud detection use cases (AWS, IAM activity, EKS/Kubernetes, container workloads), and use Wiz to track and prioritize cloud exposure as part of your detection work. * Integrate and maintain the necessary log sources (cloud, endpoints, identities, SaaS, infrastructure, Kubernetes) and improve data quality: completeness, parsing, normalization, relevance, and usability. * Identify visibility blind spots and work with the IT, Cloud, Infrastructure, and Engineering teams to reduce them. * Design, write, and optimize Splunk queries; develop new detection use cases based on available logs, refine them, and document their logic; reduce noise and improve signal quality. Incident Response * Play a leading role in investigations: gathering evidence, reconstructing timelines, and documenting actions taken. * Monitor containment, remediation, and post-incident measures. * Turn lessons learned into sustainable improvements and formalize processes: detection mechanisms, runbooks, dashboards, and automations. Contribute to automation and our Agentic SOC * Build and maintain automations (Torq/SOAR, scripts, APIs) that accelerate triage, enrichment, and response. * Contribute to the design and continuous improvement of the internal Agentic SOC—the AI system that investigates weak signals, enriches alerts, and assists with investigations—and expand its capabilities: new investigation workflows, better correlation, and tighter integration with detection and response. What we’re looking for: * Solid & proven experience in SecOps, SOC, cloud security, incident response, or infrastructure security, with a track record of building and improving SOC capabilities (logs, detections, dashboards, automations, runbooks, workflows) and conducting independent investigations. * Comfortable working in cloud and SaaS environments and with rapidly evolving technologies. * Proficiency in SecOps fundamentals: triage, investigation, incident response, log analysis, and documentation. * Strong, hands-on cloud security skills (ideally AWS): investigating IAM and identity activity, analyzing cloud audit logs (e.g. CloudTrail, GuardDuty), securing workloads, containers, and Kubernetes (EKS), and scoping cloud incidents end-to-end. Comfortable with exposure/CSPM tooling (ideally Wiz). * SIEM (ideally Splunk) with the ability to write queries for investigation and detection; EDR (ideally CrowdStrike). * Automation using Python, Bash, APIs, GitHub Actions, SOAR, or equivalent. * Interest in—or experience with—AI applied to security, agent-based workflows, and SOC automation. * Diligence, independence, technical curiosity, and attention to detail. * Ability to conduct in-depth investigations, document findings clearly, and escalate issues with the appropriate level of context; awareness of confidentiality and the proper handling of sensitive information. * Professional-level English; Ledger operates in an international environment.