[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"job-network-detection-response-engineer-coba-nearshoring-sofia-bg-de-bg":3},{"id":4,"slug":5,"title":6,"description":7,"company":8,"is_featured":11,"featured_until":7,"is_active":12,"deactivated_at":7,"is_enriched":12,"processed_job_posting_json":13,"processed_latitude":100,"processed_longitude":101,"processed_employment_types":102,"processed_working_hours":103,"processed_working_hours_labels":105,"processed_home_office":106,"processed_salary_min":97,"processed_salary_max":98,"processed_salary_currency":94,"processed_salary_source":107,"processed_benefits":108,"processed_benefits_labels":122,"processed_industry":123,"processed_skills":7,"processed_job_location":124,"processed_full_address_gmaps":126,"processed_street_gmaps":128,"processed_city_gmaps":130,"processed_postal_code_gmaps":131,"processed_country_gmaps":133,"processed_country_iso_code_gmaps":135,"full_description":16,"formatted_description":136,"processed_employment_types_labels":38,"processed_home_office_labels":36,"processed_industry_labels":40,"processed_it_skills":137,"processed_it_skills_labels":140,"processed_soft_skills":141,"processed_soft_skills_labels":142,"processed_job_expertise_skills":143,"processed_job_expertise_skills_labels":144,"processed_language_requirements":145,"processed_total_experience_years":138,"processed_professional_field":152,"processed_professional_field_labels":155,"processed_leadership_role":11,"processed_date_posted":19,"raw_job_url":156,"apply_url":7,"raw_hiringOrganization_logo_url":7,"translations":7,"canonical_industry_key":123,"canonical_industry_label":40,"max_cpc":157,"actual_cpc":7},73911,"network-detection-response-engineer-coba-nearshoring-sofia-bg","Network Detection & Response Engineer",null,{"name":9,"slug":10,"logo_url":7},"CoBa Nearshoring Sofia BG","coba-nearshoring-sofia-bg",false,true,{"@context":14,"@type":15,"title":6,"description":16,"hiringOrganization":17,"datePosted":19,"validThrough":20,"jobLocation":21,"jobLocationType":36,"employmentType":37,"industry":39,"skills":41,"baseSalary":92},"https:\u002F\u002Fschema.org\u002F","JobPosting","Wichtiger Hinweis: Bitte aktiviere JavaScript, um diese Seite uneingeschränkt nutzen zu können.\nvorherige Stelle\nnächste Stelle\nYour tasks\nTurning network data into actionable cyber defense in a large enterprise environment as part of Cyber Defense & Base Services;\nWorking with modern Network Security Monitoring (NSM), Network Detection & Response (NDR), network traffic analysis, and packet forensics;\nAnalyzing network traffic, PCAP files, flow data, and security alerts to detect attack patterns such as lateral movement, command-and-control traffic, beaconing, data exfiltration, and anomalous communication behavior;\nUsing tools such as Wireshark, tcpdump, Zeek, Suricata, and NDR platforms to support network-based threat hunting;\nImproving detection coverage by refining network-based detection logic and workflows;\nProviding reliable network evidence to support SOC operations and incident response activities;\nValidating findings, reducing false positives, and improving detection coverage in NDR environments;\nAnalyzing network protocols and packet captures using tools such as Wireshark, tcpdump, and Zeek;\nInvestigating authentication flows, DNS activity, encrypted traffic patterns, lateral movement, and suspicious communications;\nInvestigating indicators of compromise, MITRE ATT&CK techniques, beaconing activity, command-and-control channels, reconnaissance, lateral movement, and data exfiltration.\nYour Profile\nDegree or vocational training in computer science, network engineering, cyber security, business informatics or a comparable field.\n3–5+ years of experience in network security monitoring, NDR, traffic analysis, SOC support, threat hunting or operational cyber defense.\nHands-on experience with packet analysis tools such as Wireshark, tcpdump, Zeek, Suricata, Snort or similar.\nStrong knowledge of TCP\u002FIP, routing, switching, VLANs, segmentation, DMZs, NAT, proxies, VPNs and firewalls.\nFamiliarity with protocols such as DNS, DHCP, SMB, LDAP, Kerberos, HTTP\u002FS, SMTP, RDP, SSH and TLS for threat detection and forensics.\nAbility to analyze suspicious traffic, identify anomalies and investigate beaconing, lateral movement, C2 activity, reconnaissance and data exfiltration.\nExperience with NDR or visibility platforms such as Darktrace, Vectra AI, Defender for IoT, Corelight, ExtraHop, Gigamon or Armis is beneficial.\nUnderstanding of TAPs, SPAN ports, packet brokers, east-west monitoring and cloud network telemetry is an advantage.\nRelevant certifications such as CCNA\u002FCCNP, CompTIA, GIAC, Fortinet NSE or Palo Alto are valued.\nAble to take ownership of complex NDR, packet forensic and threat hunting topics and guide technical analysis.\nStructured, analytical and collaborative working style with strong troubleshooting skills.\nAble to mentor colleagues and communicate findings clearly to technical and non-technical stakeholders.\nIn return, we offer:\nGood work-life balance, including 25 days annual paid leave (increasing with 1 day per year up to 31 in total), flexible working hours, work-from-home and work from abroad opportunities;\nLuxury package of additional health and dental insurance;\nFood vouchers in the amount of EUR 80 monthly;\n6 additional annual days off for exceptional circumstances\nEmployee assistance program for psychological, financial and legal consultations;\nMultisport card;\nAnnual contribution of EUR 153.39 net per child for a summer camp\u002Fschool\u002Fkindergarten for children up to age of 15;\nPossibilities for building career-advancing skills by covering training\u002Fcertification courses and conferences based on individual learning and development needs, access to an online learning platform;\nOpportunities for long-term professional development in a stable, 150-year-old company while contributing to the vision of a new, just starting Digital Technology Center;\nFriendly and supportive multicultural environment, open to new opinions and ideas.\nCommerzbank is proud to be an equal opportunity employer, committed to creating a diverse environment. All qualified applicants will receive consideration for employment without regard to gender, race, color, national origin, religion, gender identity or expression, sexual orientation, genetics, disability, age, or any other characteristics.\nOur Benefits\nLearning Platforms\nChildren Summer Camp Contribution\nEmployee assistance program\nFood vouchers\n6 Exceptional Days Off\n25 up to 31 annual paid leave\nMultisport Card\nHealth& Dental Insurance\nWork-life balance\nWork internationally\nLearning Platforms; Children Summer Camp Contribution; Employee assistance program; Food vouchers; 6 Exceptional Days Off; 25 up to 31 annual paid leave; Multisport Card; Health& Dental Insurance; Work-life balance; Work internationally\nBookmark job ad\nPrint job ad\nShare job ad\nThe company\nCommerzbank is a leading international commercial bank with branches and offices in almost 50 countries. The world is changing, becoming digital, and so are we. We are leaving the traditional bank behind us and we are choosing to move forward as a digital enterprise.\nAs part of this strategy, Commerzbank continues the expansion of its Digital Technology Center in Sofia, Bulgaria. We need motivated people who will join us on this journey and we are looking for a\nNetwork Detection & Response Engineer\nin our\nCyber Defense and Base Services\nteam.\nWork where cyber defense meets engineering. Cyber Defense & Base Services is the center of Commerzbank’s Cyber Security Organization and provides 1st Line of Defense capabilities for operational cyber defense. The cluster develops and operates security tools used by the SOC, Threat Intelligence and other cyber security teams.\nBusiness analysts, engineers and product owners work together in agile teams to deliver reliable security capabilities, improve existing services and respond quickly to changing business and security needs. The team values ownership, open communication and continuous improvement, creating an environment where ideas are tested early, feedback is welcomed and better solutions are built together.\nContact\nApply now with your up-to-date CV in English!\nDue to the high volume of applications, we contact only the candidates who best match the role requirements. If you do not hear from us within 14 days, please consider that we won't proceed with your application at this stage.\nVerwandte Stellen\nBitte warten...\nvorherige Stelle\nnächste Stelle\nZurück\nTeilen über deinen Social Media Account\nKlicke auf eines der Icons:\nTeilen über Mail\nTeilen über Facebook\nTeilen über X\nTeilen über Xing\nTeilen über LinkedIn",{"@type":18,"name":9},"Organization","2026-07-09","2027-07-09",[22,33],{"@type":23,"address":24,"geo":29},"Place",{"@type":25,"addressLocality":26,"addressCountry":27,"addressRegion":28},"PostalAddress","Sofia","BG","Sofia City Province",{"@type":30,"latitude":31,"longitude":32},"GeoCoordinates",42.6303775,23.3766917,{"@type":23,"address":34,"geo":35},{"@type":25,"addressLocality":26,"addressCountry":27,"addressRegion":28},{"@type":30,"latitude":31,"longitude":32},"HYBRID",[38],"PERMANENT",[40],"Banking",[42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91],"Wireshark","tcpdump","Zeek","Suricata","Snort","Darktrace","Vectra AI","Defender for IoT","Corelight","ExtraHop","Gigamon","Armis","Analytical Thinking","Collaboration","Troubleshooting","Mentoring","Communication","Ownership","Network Security Monitoring","Network Detection & Response","Network Traffic Analysis","Packet Forensics","Threat Hunting","Incident Response","TCP\u002FIP","Routing","Switching","VLANs","Segmentation","DMZs","NAT","Proxies","VPNs","Firewalls","DNS","DHCP","SMB","LDAP","Kerberos","HTTP\u002FS","SMTP","RDP","SSH","TLS","MITRE ATT&CK","TAPs","SPAN ports","Packet Brokers","East-West Monitoring","Cloud Network Telemetry",{"@type":93,"currency":94,"value":95},"MonetaryAmount","EUR",{"@type":96,"minValue":97,"maxValue":98,"unitText":99},"QuantitativeValue",60000,90000,"YEAR",[31,31],[32,32],"permanent",[104],"FULL_TIME",[104],"hybrid","estimated",[109,110,111,112,113,114,115,116,117,118,119,120,121],"25 days annual paid leave (increasing with 1 day per year up to 31 in total)","Flexible working hours","Work-from-home and work from abroad opportunities","Luxury package of additional health and dental insurance","Food vouchers in the amount of EUR 80 monthly","6 additional annual days off for exceptional circumstances","Employee assistance program for psychological, financial and legal consultations","Multisport card","Annual contribution of EUR 153.39 net per child for a summer camp\u002Fschool\u002Fkindergarten for children up to age of 15","Possibilities for building career-advancing skills by covering training\u002Fcertification courses and conferences based on individual learning and development needs","Access to an online learning platform","Opportunities for long-term professional development in a stable, 150-year-old company","Friendly and supportive multicultural environment",[109,110,111,112,113,114,115,116,117,118,119,120,121],"banking",[125],"samara street, 1706, sofia, bulgarien",[127],"Mladost, ul. \"Samara\", 1715 Sofia, Bulgarien",[129],"ulitsa \"Samara\"",[26],[132],"1715",[134],"Bulgarien",[27],"Wichtiger Hinweis: Bitte aktiviere JavaScript, um diese Seite uneingeschränkt nutzen zu können.\n\nvorherige Stelle\n\nnächste Stelle\n\n## Your tasks\n\n- Turning network data into actionable cyber defense in a large enterprise environment as part of Cyber Defense & Base Services;\n- Working with modern Network Security Monitoring (NSM), Network Detection & Response (NDR), network traffic analysis, and packet forensics;\n- Analyzing network traffic, PCAP files, flow data, and security alerts to detect attack patterns such as lateral movement, command-and-control traffic, beaconing, data exfiltration, and anomalous communication behavior;\n- Using tools such as Wireshark, tcpdump, Zeek, Suricata, and NDR platforms to support network-based threat hunting;\n- Improving detection coverage by refining network-based detection logic and workflows;\n- Providing reliable network evidence to support SOC operations and incident response activities;\n- Validating findings, reducing false positives, and improving detection coverage in NDR environments;\n- Analyzing network protocols and packet captures using tools such as Wireshark, tcpdump, and Zeek;\n- Investigating authentication flows, DNS activity, encrypted traffic patterns, lateral movement, and suspicious communications;\n- Investigating indicators of compromise, MITRE ATT&CK techniques, beaconing activity, command-and-control channels, reconnaissance, lateral movement, and data exfiltration.\n\n## Your Profile\n\n- Degree or vocational training in computer science, network engineering, cyber security, business informatics or a comparable field.\n- 3–5+ years of experience in network security monitoring, NDR, traffic analysis, SOC support, threat hunting or operational cyber defense.\n- Hands-on experience with packet analysis tools such as Wireshark, tcpdump, Zeek, Suricata, Snort or similar.\n- Strong knowledge of TCP\u002FIP, routing, switching, VLANs, segmentation, DMZs, NAT, proxies, VPNs and firewalls.\n- Familiarity with protocols such as DNS, DHCP, SMB, LDAP, Kerberos, HTTP\u002FS, SMTP, RDP, SSH and TLS for threat detection and forensics.\n- Ability to analyze suspicious traffic, identify anomalies and investigate beaconing, lateral movement, C2 activity, reconnaissance and data exfiltration.\n- Experience with NDR or visibility platforms such as Darktrace, Vectra AI, Defender for IoT, Corelight, ExtraHop, Gigamon or Armis is beneficial.\n- Understanding of TAPs, SPAN ports, packet brokers, east-west monitoring and cloud network telemetry is an advantage.\n- Relevant certifications such as CCNA\u002FCCNP, CompTIA, GIAC, Fortinet NSE or Palo Alto are valued.\n- Able to take ownership of complex NDR, packet forensic and threat hunting topics and guide technical analysis.\n- Structured, analytical and collaborative working style with strong troubleshooting skills.\n- Able to mentor colleagues and communicate findings clearly to technical and non-technical stakeholders.\n\n## In return, we offer:\n\n- Good work-life balance, including 25 days annual paid leave (increasing with 1 day per year up to 31 in total), flexible working hours, work-from-home and work from abroad opportunities;\n- Luxury package of additional health and dental insurance;\n- Food vouchers in the amount of EUR 80 monthly;\n- 6 additional annual days off for exceptional circumstances\n- Employee assistance program for psychological, financial and legal consultations;\n- Multisport card;\n- Annual contribution of EUR 153.39 net per child for a summer camp\u002Fschool\u002Fkindergarten for children up to age of 15;\n- Possibilities for building career-advancing skills by covering training\u002Fcertification courses and conferences based on individual learning and development needs, access to an online learning platform;\n- Opportunities for long-term professional development in a stable, 150-year-old company while contributing to the vision of a new, just starting Digital Technology Center;\n- Friendly and supportive multicultural environment, open to new opinions and ideas.\n\nCommerzbank is proud to be an equal opportunity employer, committed to creating a diverse environment. All qualified applicants will receive consideration for employment without regard to gender, race, color, national origin, religion, gender identity or expression, sexual orientation, genetics, disability, age, or any other characteristics.\n\n## Our Benefits\n\n- Learning Platforms\n- Children Summer Camp Contribution\n- Employee assistance program\n- Food vouchers\n- 6 Exceptional Days Off\n- 25 up to 31 annual paid leave\n- Multisport Card\n- Health& Dental Insurance\n- Work-life balance\n- Work internationally\n\nLearning Platforms; Children Summer Camp Contribution; Employee assistance program; Food vouchers; 6 Exceptional Days Off; 25 up to 31 annual paid leave; Multisport Card; Health& Dental Insurance; Work-life balance; Work internationally\n\nBookmark job ad\n\nPrint job ad\n\nShare job ad\n\n## The company\n\nCommerzbank is a leading international commercial bank with branches and offices in almost 50 countries. The world is changing, becoming digital, and so are we. We are leaving the traditional bank behind us and we are choosing to move forward as a digital enterprise.\n\nAs part of this strategy, Commerzbank continues the expansion of its Digital Technology Center in Sofia, Bulgaria. We need motivated people who will join us on this journey and we are looking for a\n\n**Network Detection & Response Engineer**\n\nin our\n\n**Cyber Defense and Base Services**\n\nteam.\n\nWork where cyber defense meets engineering. Cyber Defense & Base Services is the center of Commerzbank’s Cyber Security Organization and provides 1st Line of Defense capabilities for operational cyber defense. The cluster develops and operates security tools used by the SOC, Threat Intelligence and other cyber security teams.\n\nBusiness analysts, engineers and product owners work together in agile teams to deliver reliable security capabilities, improve existing services and respond quickly to changing business and security needs. The team values ownership, open communication and continuous improvement, creating an environment where ideas are tested early, feedback is welcomed and better solutions are built together.\n\n## Contact\n\nApply now with your up-to-date CV in English!\n\nDue to the high volume of applications, we contact only the candidates who best match the role requirements. If you do not hear from us within 14 days, please consider that we won't proceed with your application at this stage.\n\n## Verwandte Stellen\n\nBitte warten...\n\nvorherige Stelle\n\nnächste Stelle\n\nZurück\n\nTeilen über deinen Social Media Account\n\nKlicke auf eines der Icons:\n\nTeilen über Mail\n\nTeilen über Facebook\n\nTeilen über X\n\nTeilen über Xing\n\nTeilen über LinkedIn",{"zeek":138,"armis":139,"snort":139,"gigamon":139,"tcpdump":138,"extrahop":139,"suricata":138,"corelight":139,"darktrace":139,"vectra ai":139,"wireshark":138,"defender for iot":139},4,3,[42,43,44,45,46,47,48,49,50,51,52,53],{"analytical thinking":138,"collaboration":138,"troubleshooting":138,"mentoring":139,"communication":138,"ownership":138},[54,55,56,57,58,59],{"dns":138,"nat":138,"rdp":138,"smb":138,"ssh":138,"tls":138,"dhcp":138,"dmzs":138,"ldap":138,"smtp":138,"taps":139,"vpns":138,"vlans":138,"http\u002Fs":138,"tcp\u002Fip":138,"proxies":138,"routing":138,"kerberos":138,"firewalls":138,"switching":138,"span ports":139,"mitre att&ck":138,"segmentation":138,"packet brokers":139,"threat hunting":138,"packet forensics":138,"incident response":138,"east-west monitoring":139,"cloud network telemetry":139,"network traffic analysis":138,"network security monitoring":138,"network detection & response":138},[60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91],{"detected_language_jobad":146,"required":147},"en",[148],[149],{"language":150,"level":151},"ENGLISH","C1",[153,154],"Information and Communications Technology Professionals","Security and Protective Services",[153,154],"https:\u002F\u002Fjobs.commerzbank.com\u002Findex.php?ac=jobad&id=61601",1]