Job Description

Our Cyber Defense Department is looking for a Cyber Defense Specialist to serve as a frontline defender of our enterprise and commercial services. Operating under the leadership of the Chief Information Security Officer (CISO), this highly specialized department encompasses our Security Operations Center (SOC), Threat Intelligence, Vulnerability Management and Security Engineering teams. In this role, you will leverage advanced security orchestration, automation, and machine learning tools to monitor our global infrastructure 24/7, continuously scanning for anomalies and turning raw security data into actionable defense strategies that keep us steps ahead of adversaries.

Digital Solutions & Development > Digital Solutions > Enterprise Cyber Security

About the Role

We are seeking a highly motivated and technically skilled Cyber Defense Specialist to join our Cyber Defense team. This position will be instrumental in enhancing enterprise detection, incident response, and SOC operational maturity across global environments.

The ideal candidate is comfortable in a high-stakes security operations role, has worked on complex cyber incidents, and can recognize opportunities to enhance detection coverage, analytical workflows, and overall cyber resilience.

This position will work closely with SOC analysts, engineering teams, vulnerability teams, and threat intelligence teams, to ensure timely response, operational excellence, and continuous improvement of security capabilities.

Key Responsibilities:

• Oversee complete investigations of high-severity, complex cybersecurity incidents impacting enterprise and commercial environments
• Analyze malicious behavior, reconstruct attack chains, and identify root cause, persistence mechanisms, and defensive gaps
• Develop and enhance detection use cases, correlation rules, dashboards, and monitoring content in collaboration with the Security Engineering team to improve threat visibility, expand detection coverage, and reduce security monitoring gaps
• Support continuous improvement of SOC operations, incident response workflows, escalation processes, and operational readiness
• Conduct forensic triage and evidence analysis across Windows, Linux/Unix, macOS, cloud, and SaaS environments
• Collaborate with cross-functional teams during cyber incident handling activities
• Oversee containment, eradication, recovery, and post-incident remediation efforts to minimize operational impact and reduce recurrence
• Produce high-quality technical documentation, executive summaries, incident reports.
• Support development and maintenance of incident response playbooks, runbooks, and standard operating procedures
• Support in conducting tabletop exercises (TTXs), cyber simulations, and operational readiness activities.
• Provide technical mentorship, investigation guidance, and knowledge sharing to SOC analysts and junior responders
• Identify opportunities for automation, telemetry enhancement, and workflow optimization to improve response efficiency and analyst effectiveness

Qualifications:

• 7+ years of experience in Security Operations, Incident Response, Threat Hunting, Digital Forensics, or Cyber Defense Operations
• Solid understanding of attacker methodologies, adversary emulation concepts, and MITRE ATT&CK framework mapping
• Practical experience with SIEM, EDR/XDR, cloud security platforms, and enterprise monitoring technologies, specifically with Microsoft tools
• Experience handling enterprise-scale security incidents in high-demand or high-availability environments
• Experienced investigative mindset with the ability to correlate multiple data sources and identify anomalous behavior patterns
• Experience improving operational processes, detection coverage, or SOC maturity initiatives
• Familiarity with enterprise security standards and frameworks such as NIST, SANS, CIS Controls, and incident response best practices
• Effective communication and stakeholder management skills with the ability to communicate technical findings to both technical and non-technical audiences
• Ability to manage priorities and maintain composure during high-severity incident scenarios

Preferred Qualifications:

• Experience supporting DFIR investigations and advanced threat response engagements
• Exposure to cloud platforms such as Microsoft Azure, AWS, or Google Cloud Platform (GCP)
• Familiarity with detection engineering, automation, SOAR workflows, or scripting
• Experience with adversary simulation, purple teaming, or threat-informed defense initiatives
• Industry certifications such as GCFA, GCIH, CySA+, Security+, SC-200, or equivalent

Our commitment to a fair hiring

At Vestas, we evaluate all candidates solely based on their professional experience, education, and relevant skills. To support a fair recruitment process, we kindly ask that you remove any photos, dates of birth or graduation, gender pronouns, marital status, or other personal information not relevant to the role before submitting your CV/resume. Your CV/resume should focus on your professional and educational background, along with the necessary contact details (email and phone number). We train our hiring teams in inclusive evaluation and regularly review process outcomes to ensure fairness.

DEIB Statement

At Vestas, we recognize the value of diversity, equity, and inclusion in driving innovation and success. We strongly encourage individuals from all backgrounds to apply, particularly those who may hesitate due to their identity or feel they do not meet every criterion. As our CEO states, "Expertise and talent come in many forms, and a diverse workforce enhances our ability to think differently and solve the complex challenges of our industry". Your unique perspective is what will help us powering the solution for a sustainable, green energy future.

BEWARE – RECRUITMENT FRAUD

It has come to our attention that there are a number of fraudulent emails from people pretending to work for Vestas. Read more via this link, https://www.vestas.com/en/careers/our-recruitment-process

About Vestas

Vestas is the energy industry’s global partner on sustainable energy solutions. We are specialised in designing, manufacturing, installing, and servicing wind turbines, both onshore and offshore.

Across the globe, we have installed more wind power than anyone else. We consider ourselves pioneers within the industry, as we continuously aim to design new solutions and technologies to create a more sustainable future for all of us. With more than 185 GW of wind power installed worldwide and 40+ years of experience in wind energy, we have an unmatched track record demonstrating our expertise within the field.

With 30,000 employees globally, we are a diverse team united by a common goal: to power the solution – today, tomorrow, and far into the future.

Vestas promotes a diverse workforce which embraces all social identities and is free of any discrimination. We commit to create and sustain an environment that acknowledges and harvests different experiences, skills, and perspectives. We also aim to give everyone equal access to opportunity.

To learn more about our company and life at Vestas, we invite you to visit our website at www.vestas.com and follow us on our social media channels. We also encourage you to join our Talent Universe to receive notifications on new and relevant postings.