Not just forwarding alerts. Not just passing incidents to someone else.
NN Digital Hub’s Cyber Defense Core team protects millions of customers worldwide. We’re looking for a Security L2 Analyst who wants to be right where cyber defense happens - investigating threats, strengthening detections, and helping shape how our CDC works.
If you know what it means to take ownership of an incident, dig into the root cause, and help your teammates grow along the way, you’ll fit right in.
A note on shifts: Our services run 24/7, so continuous monitoring is part of the job. This role includes night and weekend shifts. With a large team and a reasonable approach to planning, we keep the schedule manageable and fair.
The day-to-day: what you’ll actually be doing
- Investigate and respond to advanced security incidents across a global environment, owning them end to end, from the first alert to resolution.
- Operate and fine-tune security tools, including SIEM, EDR, NDR, and IDS/IPS.
- Work across AWS and Azure cloud environments.
- Propose and implement improvements to detection logic, playbooks, and CDC processes.
- Take part in threat hunting, purple teaming exercises, and other CDC security projects.
- Mentor junior analysts and help improve the overall maturity of our CDC.
You’ll have autonomy, trust, and space to influence how we do things, not just follow existing runbooks.
What makes this a good place to work
- Real cybersecurity: Meaningful incidents to investigate, not just an endless stream of alert noise.
- Room to learn and grow: Support for certifications, training, and continuous development.
- Hybrid working that works: A strong home office culture, flexible time off, and a setup where you can work from home most of the time. We meet in the office once a week.
- People-first team: Down-to-earth colleagues, open communication, and no unnecessary formalities. No ego, no blame. Just real support.
- The tools you need: A company laptop and iPhone with a fully paid plan.
- Benefits that add up: Cafeteria up to 20,000 CZK, pension contributions, a MultiSport card, meal allowance, a discount on life insurance, and a contribution to home office expenses.
- Referral bonus: Up to 60,000 CZK for bringing new colleagues on board.
- Onboarding built around you: More in-person support during your probation period to help you settle in.
What you’ll bring
We’re not looking for a unicorn. We’re looking for a solid blue team professional with:
- 2-4 years of experience in SOC, Blue Team, or Incident Response.
- Hands-on incident handling experience - more than copying findings into a ticket and sending them to a customer.
- An analytical approach: Take ownership of an incident, form a hypothesis, validate it, take response actions, escalate when needed, and document your work as you go.
Extra points if you also bring:
- A solid understanding of networking (OSI/TCP/IP), Windows and Linux internals, and Active Directory security.
- Practical experience with MITRE ATT&CK and the Kill Chain.
- Daily experience with tools such as Splunk, Microsoft Sentinel, Defender, CrowdStrike, Darktrace, Suricata, or similar.
- Basic scripting skills in Python, PowerShell, or Bash.
- A university degree or certifications are welcome, but not mandatory. Practical experience matters most.
From your application to an offer
First, we’ll review your CV to see how your experience matches the role. If it looks like a fit, we’ll arrange a short technical pre-screen with a couple of our senior colleagues. Next comes a longer in person interview with the team manager and Veronika from HR and then team members, where we’ll explore technical topics in more depth. If everything clicks, you’ll have a final short chat with our CDC manager. And if that goes well too, we’ll be excited to welcome you to the team!
Skills Required
- 2-4 years of experience in SOC / Blue Team / Incident Response
- Hands-on incident handling experience with end-to-end ownership
- Operate and fine-tune security tools such as SIEM, EDR, NDR, IDS/IPS
- Work across cloud environments (AWS and Azure)
- Ability to analyze incidents: form hypotheses, validate, take response actions, escalate, and document
- Shift work including night and weekend shifts
- Solid understanding of Networking (OSI/TCP/IP), Windows/Linux internals, Active Directory security
- Practical experience with MITRE ATT&CK / Kill Chain
- Daily work experience with Splunk, Microsoft Sentinel, Defender, CrowdStrike, Darktrace, Suricata (or similar)
- Scripting basics (Python / PowerShell / Bash)
- University degree or certifications
What We Do
NN Group is an international financial services company, active in 11 countries, with a strong presence in a number of European countries and Japan. Our roots lie in the Netherlands, with a rich history of more than 175 years. With our 16,000 employees, NN Group provides retirement services, pensions, insurance, banking and investments to approximately 19 million customers. NN Group includes Nationale-Nederlanden, NN, ABN AMRO Insurance, Movir, AZL, BeFrank, OHRA and Woonnu. NN Group opened for trading on 2 July 2014 on Euronext Amsterdam under the symbol ‘NN’ after its initial public offering (IPO). For more than 175 years, our company has merged, grown and changed, but the core of who we are has remained the same. At NN Group, we put our resources, expertise, and networks to use for the well-being of our customers, the advancement of our communities, the preservation of our planet, and for the promotion of a stable, inclusive, and sustainable economy. Our purpose is to help people care for what matters most to them. Because what matters to them matters to us.
.png){kind=logo}
