PpWe are all in at Swissquote. As an equal opportunity employer, we welcome candidates from all backgrounds, experiences and perspectives to join our team and contribute to our shared success. /p h3Job Description /h3 pJoin our Security Operations Center (SOC) Team, a team of four engineers within the Cybersecurity Department. You will work in a dynamic environment, gaining key skills in security automation and incident response while becoming familiar with the banking and finance threat landscape. Under the supervision of the Security Operation Manager, you will take part in the following projects: /p ul liPlaybook Engine Development: Building and enhancing the core SOAR playbook execution engine using Python 3.9+. Implementing YAML parser, workflow executor, conditional logic evaluator, and decision tree engine. /li liPlaybook Creation: Designing YAML-based SOAR playbooks for automated incident response. Creating workflows for phishing detection, malware analysis, ransomware response, threat intelligence enrichment, and IOC blocking. /li liCustom Utility Development: Developing Python utility functions and helpers to extend playbook capabilities. Building data transformation logic and security analysis functions. Execution Framework: Implementing error handling, logging, monitoring, performance optimization, parallel execution, and async operations. /li liTesting Quality Assurance: Writing unit tests and creating regression test suites. Testing playbooks with realistic security scenarios and validating end-to-end automation flows. Implementing and enforcing coding standards through linting tools. /li liCollaboration: Working closely with the Integration Intern to understand available connectors and ensure playbooks effectively utilize all integrations. /li /ul h3Qualifications /h3 ul liGood proficiency in Python /li liGood knowledge of YAML syntax and workflow definition /li liBasic understanding of cybersecurity fundamentals and incident response /li liInterest in security operations and SOC processes /li liFamiliarity with threat landscapes and security concepts /li liBasic experience writing tests or willingness to learn /li liExperience with version control (Git) /li /ul h3Nice-to-Have Skills /h3 ul liExperience with SOAR platforms (Splunk SOAR, Cortex XSOAR, etc.) /li liFamiliarity with security tools (Splunk, QRadar, Chronicle, CrowdStrike) /li liExperience with linting tools /li liKnowledge of workflow engines or orchestration systems /li /ul pAvailability: from July 1st 2026 /p /p #J-18808-Ljbffr