Cyber SOC L3 - Manager - EY GDS Spain - Hybrid at EY

✨ The Stack take on this EY job

• 🏢 EY has 15 jobs here, 9 with visa sponsorship see all
• 🛂 Visa: Highly Qualified Professional permit. Education: Higher education degree guide
• 💡 No salary shown. Ask EY if it is above the minimum.

Updated 2026-11-02, from our data and official sources.

Apply with your AI assistant

With The Stack connected to Claude, ChatGPT or Cursor, paste this. Your assistant tailors your CV and cover letter, checks the visa facts and gives you the apply link.

Help me apply to this job on The Stack: https://jobs.trythestack.co/jobs/cyber-soc-l3-manager-ey-gds-spain-hybrid-ey

Not connected yet? Connect in a minute. To help your user apply, call the MCP tool prepare_application with slug "cyber-soc-l3-manager-ey-gds-spain-hybrid-ey": it returns the apply link, the visa facts and a CV and cover letter checklist. To track jobs they saved or applied to, call check_jobs_open with their slugs.

About the role

Responsibilities:
- Lead SOC Level 3 response to high-severity incidents across a 24x7 operations model: coordinate containment, eradication and recovery.
- Perform deep forensic investigations: evidence collection, memory and endpoint analysis, packet capture interpretation (Wireshark/TCPdump) and timeline construction.
- Use SIEM and EDR/XDR tools to triage alerts, perform hunting and validate incidents (Splunk, Sentinel, LogScale, Chronicle, QRadar, CrowdStrike, Defender, etc.).
- Develop and improve incident response playbooks, runbooks and detection rules; document lessons learned and produce executive summaries.
- Coordinate with IT, security teams and external parties; lead incident calls and communicate technical findings to stakeholders.
- Mentor and coach L1/L2 responders and contribute to capability building and process enhancements.

Requirements:
- 5+ years of hands-on experience in SOC, incident response or digital forensics in an enterprise environment.
- Proficiency with SIEM platforms (e.g., Splunk, Microsoft Sentinel, LogScale, Chronicle, QRadar) and EDR/XDR solutions (CrowdStrike, Defender, SentinelOne, Cortex XSIAM, Carbon Black).
- Strong skills in forensic techniques, endpoint/live response, memory analysis, packet analysis and log correlation.
- Scripting ability in Python and/or PowerShell for automation and investigations.
- Solid understanding of security frameworks and controls (SANS Top 20, OWASP) and incident response lifecycle.
- Comfortable operating in a 24x7 SOC; strong communication and stakeholder management skills. Certifications (e.g., GCFA, GCIH, CISSP) are desirable.

Responsibilities

Lead the response to high-severity security incidents in a 24/7 SOC, coordinating with IT and security teams, performing evidence collection and forensic analysis, and presenting findings to stakeholders. Develop and improve incident response playbooks, and prepare detailed incident reports and executive summaries.

Requirements

5+ years of security experience (SOC/IR/forensics). Proficient with SIEM and EDR/XDR platforms (Splunk, Microsoft Sentinel, CrowdStrike, etc.), scripting in Python or PowerShell, and malware analysis. Strong understanding of network protocols, security controls, and incident response processes; willingness to work in a 24/7 operations center.

Key skills

• Splunk — in 6 other listings on The Stack
• Microsoft Sentinel — not in any other listing on The Stack
• LogScale — not in any other listing on The Stack
• Google Chronicle — not in any other listing on The Stack
• IBM QRadar — not in any other listing on The Stack
• CrowdStrike — in 2 other listings on The Stack
• Microsoft Defender — not in any other listing on The Stack
• SentinelOne — in 1 other listing on The Stack
• Cortex XSIAM
• Carbon Black
• Python
• PowerShell

On The Stack (as of 2026-11-02)

• EY has 14 other listings on The Stack, 8 of them marked as offering visa sponsorship.
• 64 visa-sponsored jobs in Spain on The Stack, posted in the last 60 days.

Frequently asked questions about EY

Is this Cyber SOC L3 - Manager - EY GDS Spain - Hybrid role still open?

It was posted on 2026-11-01 and is listed as active on The Stack. Confirm on EY's application page before applying.

Does EY offer visa sponsorship?

This listing is marked as offering visa sponsorship. Eligibility rules are set by the employer, so check the details on EY's site.

Where is this role located?

The listing gives the location as Málaga, ES, Spain. It is marked on-site.

What skills does this role ask for?

The listing names: Splunk, Microsoft Sentinel, LogScale, Google Chronicle, IBM QRadar, CrowdStrike, Microsoft Defender, SentinelOne, Cortex XSIAM, Carbon Black, Python, PowerShell.