Network Detection & Response Engineer (m/f/diverse)

Your tasks

• Turning network data into actionable cyber defense in a large enterprise environment as part of Cyber Defense & Base Services;
• Working with modern Network Security Monitoring (NSM), Network Detection & Response (NDR), network traffic analysis, and packet forensics;
• Analyzing network traffic, PCAP files, flow data, and security alerts to detect attack patterns such as lateral movement, command-and-control traffic, beaconing, data exfiltration, and anomalous communication behavior;
• Using tools such as Wireshark, tcpdump, Zeek, Suricata, and NDR platforms to support network-based threat hunting;
• Improving detection coverage by refining network-based detection logic and workflows;
• Providing reliable network evidence to support SOC operations and incident response activities;
• Validating findings, reducing false positives, and improving detection coverage in NDR environments;
• Analyzing network protocols and packet captures using tools such as Wireshark, tcpdump, and Zeek;
• Investigating authentication flows, DNS activity, encrypted traffic patterns, lateral movement, and suspicious communications;
• Investigating indicators of compromise, MITRE ATT&CK techniques, beaconing activity, command-and-control channels, reconnaissance, lateral movement, and data exfiltration.

Your Profile

• Degree or vocational training in computer science, network engineering, cyber security, business informatics or a comparable field.
• 3-5+ years of experience in network security monitoring, NDR, traffic analysis, SOC support, threat hunting or operational cyber defense.
• Hands-on experience with packet analysis tools such as Wireshark, tcpdump, Zeek, Suricata, Snort or similar.
• Strong knowledge of TCP/IP, routing, switching, VLANs, segmentation, DMZs, NAT, proxies, VPNs and firewalls.
• Familiarity with protocols such as DNS, DHCP, SMB, LDAP, Kerberos, HTTP/S, SMTP, RDP, SSH and TLS for threat detection and forensics.
• Ability to analyze suspicious traffic, identify anomalies and investigate beaconing, lateral movement, C2 activity, reconnaissance and data exfiltration.
• Experience with NDR or visibility platforms such as Darktrace, Vectra AI, Defender for IoT, Corelight, ExtraHop, Gigamon or Armis is beneficial.
• Understanding of TAPs, SPAN ports, packet brokers, east-west monitoring and cloud network telemetry is an advantage.
• Relevant certifications such as CCNA/CCNP, CompTIA, GIAC, Fortinet NSE or Palo Alto are valued.
• Able to take ownership of complex NDR, packet forensic and threat hunting topics and guide technical analysis.
• Structured, analytical and collaborative working style with strong troubleshooting skills.
• Able to mentor colleagues and communicate findings clearly to technical and non-technical stakeholders.

In return, we offer:

• Good work-life balance, including 25 days annual paid leave (increasing with 1 day per year up to 31 in total), flexible working hours, work-from-home and work from abroad opportunities;
• Luxury package of additional health and dental insurance;
• Food vouchers in the amount of EUR 80 monthly;
• 6 additional annual days off for exceptional circumstances
• Employee assistance program for psychological, financial and legal consultations;
• Multisport card;
• Annual contribution of EUR 153.39 net per child for a summer camp/school/kindergarten for children up to age of 15;
• Possibilities for building career-advancing skills by covering training/certification courses and conferences based on individual learning and development needs, access to an online learning platform;
• Opportunities for long-term professional development in a stable, 150-year-old company while contributing to the vision of a new, just starting Digital Technology Center;
• Friendly and supportive multicultural environment, open to new opinions and ideas.

Commerzbank is proud to be an equal opportunity employer, committed to creating a diverse environment. All qualified applicants will receive consideration for employment without regard to gender, race, color, national origin, religion, gender identity or expression, sexual orientation, genetics, disability, age, or any other characteristics.

The company

Commerzbank is a leading international commercial bank with branches and offices in almost 50 countries. The world is changing, becoming digital, and so are we. We are leaving the traditional bank behind us and we are choosing to move forward as a digital enterprise.

As part of this strategy, Commerzbank continues the expansion of its Digital Technology Center in Sofia, Bulgaria. We need motivated people who will join us on this journey and we are looking for a Network Detection & Response Engineer in our Cyber Defense and Base Services team.

Work where cyber defense meets engineering. Cyber Defense & Base Services is the center of Commerzbank’s Cyber Security Organization and provides 1st Line of Defense capabilities for operational cyber defense. The cluster develops and operates security tools used by the SOC, Threat Intelligence and other cyber security teams.

Business analysts, engineers and product owners work together in agile teams to deliver reliable security capabilities, improve existing services and respond quickly to changing business and security needs. The team values ownership, open communication and continuous improvement, creating an environment where ideas are tested early, feedback is welcomed and better solutions are built together.

Contact

Apply now with your up-to-date CV in English!

Due to the high volume of applications, we contact only the candidates who best match the role requirements. If you do not hear from us within 14 days, please consider that we won't proceed with your application at this stage.