Area Lead - Security Engineering v Praha, Česko

Area Lead owns the security operations, vulnerability management, identity governance, and NIS2 compliance posture for the managed infrastructure estate.

Own end-to-end security service delivery: SIEM monitoring, alert triage, vulnerability scanning, patch compliance tracking, endpoint protection, and identity/access governance Hold EPAM's NIS2 compliance sign-off chain for managed infrastructure — own audit evidence and regulatory reporting Lead security transition-in: tooling onboarding, runbook authorship, current-state risk assessment, and knowledge transfer from incumbent vendors Govern a team of 6 offshore security engineers across operations, incident response, and change security reviews Interface directly with the client's CISO team and retained SOC function Drive security posture improvement — KPIs, metrics, and continuous improvement cycles Manage security incidents through the escalation chain to the client 7+ years in security engineering or SOC operations Microsoft Sentinel — SIEM administration, detection rule authoring, alert triage Microsoft Defender — EDR management and policy governance Tanium — endpoint visibility and remediation Tenable — vulnerability scanning, prioritisation, and reporting Microsoft Entra ID — PIM, conditional access, identity governance CyberArk — PAM vault operations and onboarding CyberArk EPM — shadow IT and endpoint privilege management Palo Alto Cortex / Prisma — cloud security posture (migration from Prisma to Cortex in progress) NIS2 Directive — working knowledge of compliance requirements and evidence chains MSP or outsourcing background — experience governing remote delivery teams English — fluent; German or Czech — strong asset CISSP, CISM, or equivalent Microsoft SC-200 (Security Operations Analyst)