Cybersecurity Operations Engineer

Role based in Barcelona - 3 days office / 2 days homeAs a Cybersecurity Operations Engineer at Evinova, you will play a key role in strengthening our operational security posture by leading hands-on technical activities across detection engineering, incident response, and cloud security. You will work within the Cybersecurity Operations function to ensure continuous monitoring, visibility, and control across cloud, SaaS, and enterprise platforms.The role focuses on the operation and optimization of our SIEM and SOAR platforms (Splunk Cloud Enterprise Security and Splunk SOAR), integrating critical data sources from AWS, Microsoft 365, and SaaS environments, and developing high-fidelity detections that enable proactive threat response. You will also provide technical leadership supporting IT, Infrastructure, and Cloud teams in implementing hardening standards, configuration validation, and secure-by-design practices.Success in this role means maintaining strong visibility across our digital landscape, driving automation for detection and response, and ensuring that cloud and endpoint platforms remain protected and compliant with Evinova's cybersecurity standards and global frameworks such as ISO 27001, SOC 2, and NIST CSF.This position is ideal for a technically skilled cybersecurity professional who thrives in a fast-paced global environment and enjoys solving complex operational challenges while contributing directly to securing Evinova's digital health platforms.Key Responsibilities : Security Monitoring and Detection Engineering

• Maintain and operate the organization's SIEM and SOAR platforms (Splunk Enterprise Security and SOAR) to ensure continuous, reliable, and scalable security monitoring.
• Develop and manage log source integrations across cloud and SaaS environments including infrastructure, applications, identity providers, and endpoints.
• Collaborate with the external SOC on rule tuning, enrichment mapping, and validation of false-positive reduction efforts.
• Create and maintain dashboards, reports, and visualizations to support SOC operations, threat hunting, and management visibility.
• Monitor and optimize SIEM ingestion performance, ensuring efficient parsing, filtering, and normalization of logs to control license consumption.
• Conduct periodic use-case reviews to ensure alignment with the evolving threat landscape, business priorities, and technology stack.Incident Response and Operations Support
• Collaborate with the Security Operations, Incident Response, and Threat Intelligence teams to improve detection coverage and response playbooks.
• Provide tier-3 support during incident investigations, including forensic data extraction and SIEM correlation analysis.
• Participate in on-call escalation for critical incidents requiring Splunk or SOAR expertise.
• Support IT and Cloud teams during investigations involving phishing,