{"id":3004123,"url":"https://alion.io/job/green-castle-digital-senior-cyber-security-engineer","title":"Senior Cyber Security Engineer","company":{"id":4457459,"name":"Green Castle Digital","domain":"greencastledigital.com","url":"https://alion.io/company/green-castle-digital","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Teamtailor","truth_index":{"grade":"B","score":75,"open_postings":3,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-28T05:59:10Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Belgrade, Serbia"],"countries":["RS"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":41000,"max_usd":95000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2372},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Amazon EKS","optional":false},{"name":"AWS","optional":false},{"name":"Cortex XDR","optional":false},{"name":"Diamond Model","optional":false},{"name":"IAM","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Kubernetes","optional":true}],"status":"live","first_seen_at":"2026-07-21T11:31:02Z","employer_posted_date":"2026-07-21","last_verified_at":"2026-10-28T07:27:41Z","board_verified":true,"closed_at":null,"days_open":99,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":98},"description":"Job Title: Senior Cyber Security Engineer\nLocation: Belgrade (Hybrid)\nDepartment: Product & Technology - Cyber Security\nReports to: Head of Cybersecurity\nJob type: Full time. On-call rotation.\nRole purpose\nThe Security Engineer in the Cyber Defence team is the senior hands-on defender working alongside the Head of Cybersecurity. They build, tune and operate the detection and response capability that protects BOYLE Sports and Greencastle Digital against active threat. They write detections, run hunts, investigate alerts that the MSSP escalates, and stand on the bridge during incidents.\nThis is an engineering role inside the Cyber function. It is distinct from the Security Engineers in the CCoE, who build platform security capability. This role builds defensive capability - the rules, automations, integrations and tooling that let BOYLE Sports & GCD see and stop attacks.\nKey responsibilities\nDetection engineering\nDesign, write, test and tune detections across Cortex XDR / XSIAM, cloud telemetry (AWS CloudTrail, GuardDuty, EKS audit logs), identity telemetry (Entra ID, on-premises AD), endpoint, network and application logs.\nTreat detections as code. Version-control rules, peer-review changes, write tests, measure coverage against MITRE ATT&CK, and retire detections that no longer earn their keep.\nOwn log onboarding and parsing for new sources. Work with platform and application engineering teams to make sure new services produce useful telemetry on day one, not retro-fitted six months later.\nThreat hunting and investigation\nRun structured threat hunts against hypotheses derived from threat intelligence, recent incidents and attacker tradecraft relevant to online gambling (account takeover, bonus abuse-adjacent fraud rings, payments-targeted intrusion, ransomware operator TTPs).\nLead deep-dive investigations on alerts escalated from the Palo Alto MSSP. Determine root cause and full scope before handing back for containment.\nDocument findings well enough that the next analyst, six months later, can pick up the trail.\nIncident response\nStand on the bridge during P1 and P2 incidents. Drive containment and eradication actions personally, in concert with platform, infrastructure and product engineering teams.\nOwn the technical timeline, the indicators of compromise, the evidence trail and the artefacts needed for regulator notification and post-incident review.\nDeputise for the Head of Cybersecurity as Incident Commander when required.\nAutomation and SOAR\nBuild and maintain SOAR playbooks. Automate the repetitive parts of triage, enrichment, containment and notification so the team’s attention goes to the parts that need a human.\nIntegrate detection and response tooling with the wider stack - ticketing, chat, identity, cloud control planes - using clean, supportable code.\nMSSP partnership\nBe the team’s primary technical interface to the Palo Alto managed SOC. Review their detections, challenge their analysis, give feedback that improves quality, and escalate when it doesn’t.\nRun regular detection and response exercises with the MSSP. Make sure playbooks survive contact with reality.\nPurple teaming and validation\nWork with offensive security partners to run purple-team exercises. Translate red findings into hardened detections and tested response procedures.\nUse breach-and-attack-simulation tooling to continuously validate detection coverage.\nExperience and qualifications\nRequired\nDemonstrable hands-on experience as a SOC analyst (senior / tier 3), detection engineer, threat hunter or incident responder. Candidates must be able to talk in concrete terms about detections they have written, hunts they have led, and incidents they have worked.\nStrong working knowledge of at least one major SIEM/XDR platform and the query language behind it. Palo Alto Cortex XDR / XSIAM and XQL are ideal. Splunk, Sentinel, Elastic or Chronicle backgrounds are entirely acceptable provided the candidate can clearly cross over.\nPractical experience investigating in AWS - CloudTrail, GuardDuty, VPC flow logs, EKS audit logs, IAM analysis. Comfortable reading JSON event data and reasoning about API-call chains.\nScripting competence in Python or an equivalent - enough to parse evidence, write SOAR steps, and build small tools without waiting for someone else.\nSolid grounding in MITRE ATT&CK, the diamond model and a structured approach to investigation. Able to write a clear incident timeline.\nCalm under pressure. Comfortable on a bridge call at 03:00.\nStrongly preferred\nExperience in online gambling, payments, financial services or another high-volume consumer environment with active fraud and account takeover pressure.\nExposure to retail or distributed-endpoint estates (point-of-sale-like devices, SD-WAN, Intune-managed fleets).\nExperience working with or inside an outsourced SOC arrangement.\nCertifications and education\nPractitioner certifications such as GCIA, GCIH, GCFA, GNFA, BTL1 or equivalent are valued. Vendor certifications in the relevant detection stack are a plus.\nA relevant degree is welcome but not required.\nAbout Greencastle Digital\nWelcome to Greencastle Digital - where technology meets innovation in the exciting world of betting and gaming. Based in Belgrade, Serbia, we bring together talented people from all areas of digital tech, product development, customer experience, and marketing to create cutting-edge solutions.\nAt Greencastle Digital, it’s not just about building great technology - it’s about shaping the future of gaming and creating unforgettable experiences for our global players and partners. Whether you’re working on ground breaking tech, designing immersive games, or crafting customer-first solutions, you’ll be part of a dynamic, collaborative team where creativity and fresh ideas are always welcome.","description_format":"text","description_chars":5804,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[{"name":"Serbia","iso":"RS","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-21T13:08:32Z"}],"visa":[],"liveness":{"score":11,"band":"cold","label":"Long shot","p_open":1,"p_active":0.4,"p_room":0.28,"age_days":98,"expected_fill_days":36,"reasons":["conf:14","win:tail","crowd:"],"computed_at":"2026-10-28T05:59:10Z"},"pay":null,"html_url":"https://alion.io/job/green-castle-digital-senior-cyber-security-engineer","json_url":"https://alion.io/job/green-castle-digital-senior-cyber-security-engineer.json","meta":{"generated_at":"2026-10-28T12:15:50Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":16155,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-29T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4457459},"rest":"https://alion.io/mcp/rest/get_company?id=4457459"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fgreen-castle-digital-senior-cyber-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fgreen-castle-digital-senior-cyber-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fgreen-castle-digital-senior-cyber-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/green-castle-digital-senior-cyber-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fgreen-castle-digital-senior-cyber-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3004123}},{"tool":"search_jobs","arguments":{"company":"greencastledigital.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3004123},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}