SOC and incident response jobs in Spain

30 open SOC and incident response roles at 20 companies in Spain. None of them states a citizenship or security-clearance demand. 4 mention relocation support.

Rebuilt 25 Oct 2026
open roles
30
companies
20
open to any nationality
100%
estimated median pay
$79k

Companies hiring

CompanyOpen rolesAny nationalityRelocation
GFT Technologies4100%
Schwarz Group3100%
GMV Transit - Simplifying the world of transit.3100%3
Inetum2100%
Amazon2100%
Devoteam2100%
Miratech1100%1
Babel1100%
Allianz1100%
Aleph1100%
Indra Group1100%
Syntegon1100%
Delivery Hero1100%
Rockwell Automation1100%
EY1100%

Newest roles

gmvtransit.com • Warsaw • Barcelona • Bogotá • Lisbon • Bucharest • Transportation & Logistics • 11-50 employees • Est. 2012 • Trust B • Hiring 184, 10 new
Warsaw • Barcelona • Bogotá • Lisbon • Bucharest • Transportation & Logistics • 11-50 employees • Est. 2012 • Trust B • Hiring 184, 10 new
GMV North America A track record you can ride with. GMV is an American company with a proven history of modernizing transit agencies, from Los Angeles to Houston to the greater New York area and beyond.
No named decision-maker yet.
No careers mailbox known
Verified live · 2 hours ago 4 days ago Likely open · 63%

SIEM Systems Engineer – Paris

≈ $42k – $115k per year (Estimated) • Hybrid (Tres Cantos, Spain) • Relocation
Red Teaming
DevOps
Windows
Linux
Cybersecurity
SIEM
ISO 27001
GDPR
Apply
Verified live · 2 hours ago 5 days ago Likely open · 62%

SOC/CERT Service Manager

≈ $42k – $115k per year (Estimated) • Hybrid (Tres Cantos, Spain) • Relocation
Red Teaming
DevOps
Windows
Linux
Cybersecurity
SIEM
ISO 27001
GDPR
Apply

NOW Systems -

nowsystems.eu
nowsystems.eu • HQ: Zaragoza, Spain • High-Performance Computing • Predictive Analytics • Information Technology • 1-10 employees • Est. 2018 • Likely startup • Hiring 5, 5 new
HQ: Zaragoza, Spain • High-Performance Computing • Predictive Analytics • Information Technology • 1-10 employees • Est. 2018 • Likely startup • Hiring 5, 5 new
NOW Systems - Oceanic Technological Consulting focused on Data Assembly, Monitoring & Forecasting, AI and development.
No named decision-maker yet.
No careers mailbox known
Verified live · 2 hours ago 5 days ago Hiring now · 88%

Operador SOC - Nologin Madrid

≈ $39k – $106k per year (Estimated) • In office (Madrid, Spain) • Spanish: C1
SIEM
Apply

Deloitte Spain

deloitte.es
deloitte.es • HQ: Madrid, Spain • IT Consulting & Digital Transformation • Tax Advisory & Preparation • Management Consulting • Audit & Assurance Firms • Trust A • Hiring 158, 29 new
HQ: Madrid, Spain • IT Consulting & Digital Transformation • Tax Advisory & Preparation • Management Consulting • Audit & Assurance Firms • Trust A • Hiring 158, 29 new
Deloitte Spain is the Spanish member firm of the Deloitte network, headquartered in Madrid, providing audit, consulting, risk advisory, tax and legal, and financial advisory services to Spanish and international organisations. It works from offices across Spain, including Barcelona, Bilbao, Zaragoza, Seville, Valencia, A Coruña, Vigo, Oviedo and Las Palmas, and runs a Deloitte Engineering Center for technology delivery. It hires junior CRM and IT consultants, data engineers with Databricks skills, AWS and cloud architects, artificial intelligence specialists, HR generalists and purchasing technicians.
No named decision-maker yet.
No careers mailbox known
Verified live · 2 hours ago 6 days ago Hiring now · 90%

Managed Extended Detection and Response Analyst (MXDR) - SOC Team

≈ $37k – $87k per year (Estimated) • Middle • 3+ years exp • In office (Madrid, Spain) • Middle • Spanish: C1
Crowdstrike
Darktrace
SentinelOne
Microsoft Defender
Cortex XDR
Threat Modeling
Apply

KPMG

kpmg.es
kpmg.es • HQ: Madrid, Spain • Information Security • Artificial Intelligence • Cybersecurity • 501-1000 employees • Hiring 82, 9 new
HQ: Madrid, Spain • Information Security • Artificial Intelligence • Cybersecurity • 501-1000 employees • Hiring 82, 9 new
Headquartered in Madrid, Spain, KPMG is a prominent professional services network providing audit, tax, and advisory services to businesses across various industries. The firm helps clients navigate complex regulatory environments, optimize operational performance, and drive digital and sustainable transformations. By combining deep industry knowledge with advanced technological capabilities, it empowers organizations to manage risk and foster sustainable growth.
No named decision-maker yet.
Careers mailbox is known
Verified live · 1 day ago 6 days ago Hiring now · 90%

Tech Program - Prácticas Ciberdefensa (SOC/MDR) - Enero 2027 Madrid

≈ $39k – $106k per year (Estimated) • In office (Madrid, Spain) • Internship • Spanish: C1
SIEM
Apply

Orange

orange.com
orange.com • HQ: Issy-les-Moulineaux, France • Managed Security • Telecom Infrastructure • Systems Integrators • Broadband • Mobile Networks • 5000+ employees • Est. 1988 • Trust A • Hiring 539, 128 new
HQ: Issy-les-Moulineaux, France • Managed Security • Telecom Infrastructure • Systems Integrators • Broadband • Mobile Networks • 5000+ employees • Est. 1988 • Trust A • Hiring 539, 128 new
Orange is the leading French telecommunications operator and one of the largest network groups in Europe and Africa. Beyond mobile and fibre access it runs enterprise IT and integration through Orange Business, cybersecurity through Orange Cyberdefense and mobile financial services through Orange Money. The company is partly owned by the French state and is headquartered in Issy-les-Moulineaux.
Darwin Hu · Executive Officer · decision-maker
Christel Heydemann · Directeur Général · decision-maker
Jacques Aschenbroich · Président du conseil d’administration · decision-maker
Jeffrey Drazan · Executive Officer, Director · decision-maker
No careers mailbox known
Verified live · 1 hour ago 12 days ago Fading · 32%

Junior SOC Analyst with French&Spanish (M/F) - based in Spain

≈ $24k – $69k per year (Estimated) • Junior • Hybrid (Madrid, Spain) • Master's Degree • Full-Time • Junior • French: C1 • Spanish • English
Crowdstrike
SentinelOne
Microsoft Defender
Cortex XDR
Cyber Kill Chain
SIEM
Apply

SIX

six-group.com
six-group.com • HQ: Zurich, Switzerland • Events & Ticketing • Cybersecurity • Data Providers & Datasets • Financial Services • Payment Processing & Gateways • Financial Data & Market Intelligence • Stock Exchanges & Market Infrastructure • 1001-5000 employees • Est. 2008 • Hiring 79, 8 new
HQ: Zurich, Switzerland • Events & Ticketing • Cybersecurity • Data Providers & Datasets • Financial Services • Payment Processing & Gateways • Financial Data & Market Intelligence • Stock Exchanges & Market Infrastructure • 1001-5000 employees • Est. 2008 • Hiring 79, 8 new
SIX is a Swiss financial market infrastructure group headquartered in Zurich that operates stock exchanges, securities settlement and custody, banking and payment services and financial information. Formed in 2008 from the merger of Swiss financial companies and owned by banks, it runs the SIX Swiss Exchange and, since acquiring BME, the Spanish stock exchanges in Madrid, with further offices in London, Warsaw, Frankfurt and Stockholm. It hires Java and full-stack developers, test and platform engineers, product and project managers, business analysts, controllers, internal auditors and interns in Madrid, Zurich and Warsaw.
No named decision-maker yet.
Careers mailbox is known
Verified live · 5 hours ago 13 days ago Hiring now · 80%

SOC Analyst

≈ $38k – $90k per year (Estimated) • Middle • 4+ years exp • In office (Las Rozas de Madrid, Spain) • Middle
Python
DevOps
Cortex
GitLab
Azure DevOps
CI/CD
Prometheus
Azure
Cybersecurity
MITRE ATT&CK
Cortex XSOAR
SIEM
+2
Apply

Skills these roles ask for

SIEM 22MITRE ATT&CK 8Linux 7Windows 7Microsoft Sentinel 6Splunk 6ServiceNow 5ISO 27001 5Crowdstrike 4SentinelOne 4IBM QRadar 4Microsoft Defender 4ITIL 4Python 3GCP 3Cortex XDR 3

Where the roles are

Madrid 13Barcelona 7Tres Cantos 4Sant Cugat del Vallès 4Terrassa 1Málaga 1Las Rozas de Madrid 1

Other specialties in Spain

Questions

Can a foreigner apply for these roles?

30 of the 30 roles here state no citizenship or security-clearance demand. A role that does says so in its advert, and the card marks it.

Which companies hire most cybersecurity specialists?

GFT Technologies (4), Schwarz Group (3), GMV Transit - Simplifying the world of transit. (3), Inetum (2), Amazon (2).

Which roles count as cybersecurity jobs?

Every role whose work is protecting systems and data - SOC and incident response, threat intelligence and forensics, application and cloud security, authorized penetration testing and vulnerability management, identity and access, governance, risk and compliance, security leadership - at any employer. A role is filed under a specialty when its title names one; a "Cybersecurity Engineer" that names none is a cybersecurity engineer's.

How fresh is this?

Every role is re-checked on the employer's own careers board at least every 48 hours, and the page is rebuilt every night.

Source: 30 live postings on employers' careers boardsUpdated 25 Oct 2026MethodologyJSONCC BY-SA 4.0