Security Monitoring Platform Developer (Azure Developer)

Bayer seeks a Cyber Security Engineer to design and maintain custom security automation applications within the CDC Cyber Security Monitoring squad, focusing on Azure-native application pipelines and integrations with Microsoft Sentinel and Azure Data Explorer.

• Strong hands-on development experience in Python, including Azure Functions, async processing, and API integrations
• Experience with Azure PaaS services: Function Apps, Logic Apps, Service Bus, Key Vault, Event Hub, Application Insights
• Solid understanding of REST APIs, JSON, and data serialization formats (STIX, MISP event format)
• Experience with SQL databases and data pipeline patterns (Azure SQL, ADX/KQL is a strong plus)
• Knowledge of Git-based workflows, Infrastructure as Code (Terraform), and CI/CD (GitHub Actions)
• Experience in IT Security, SIEM, or related field; understanding of security incident lifecycle, detection engineering, and threat intelligence concepts
• Understanding of IT and enterprise systems including business processes and data flows
• Strong collaboration skills and ability to work in global teams across time zones
• University degree or equal experience, preferably in Computer Science, Information Technology, or Cyber Security
• Excellent oral and written communication skills in English; German is a plus

• Develop and maintain the Checkmail automation pipeline using Azure-native services including Function Apps in Python, Logic Apps, Service Bus, ADX data persistence, and Sentinel incident creation
• Implement and operate the MISP2Sentinel threat intelligence connector using Azure Function Apps with PyMISP and MISP-STIX libraries
• Develop Azure Function Apps in Python for SQL-based data replication between Azure SQL Database, ADX, and Sentinel
• Design and implement complex security incident handling workflows in Microsoft Sentinel including enrichment workflows, Analytics Rules, Automation Rules, and Logic App-based orchestration
• Integrate external security APIs and services into the SIEM platform with error handling and retry logic
• Follow established Infrastructure as Code deployment processes using GitHub Actions, Terraform, and GitHub repositories
• Ensure application reliability with structured logging, health monitoring, Application Insights instrumentation, and proactive alerting
• Support content handover and documentation, follow naming conventions and integrate components into RBAC and deployment models
• Collaborate with analysts to translate detection and automation requirements into scalable applications

Contract title is Cyber Security Engineer. Position is for Digital Hub Warsaw. Equal pay and transparency commitment in line with EU and local regulations.