# Cyber SOC L3 - Manager - EY GDS Spain - Hybrid at EY

> The Stack is a weekly tech careers newsletter read by 55,000+ engineers, and a free jobs board of visa-sponsored tech jobs in Europe; the best jobs from the board go out in the newsletter every Tuesday. This is one job from the board.

> Responsibilities: - Lead SOC Level 3 response to high-severi

- **Company:** EY (https://jobs.trythestack.co/companies/ey)
- **Location:** Málaga, ES, Spain
- **Work arrangement:** On-site
- **Employment type:** Full-time
- **Experience level:** 5–10 years
- **Visa sponsorship:** Offered, according to the listing
- **Key skills:** Splunk, Microsoft Sentinel, LogScale, Google Chronicle, IBM QRadar, CrowdStrike, Microsoft Defender, SentinelOne, Cortex XSIAM, Carbon Black, Python, PowerShell
- **Posted by employer:** 2026-11-01
- **Added to The Stack:** 2026-11-02
- **Listed until:** 2026-12-31
- **Status:** Active
- **Apply:** https://careers.ey.com/ey/job/Malaga-Cyber-SOC-L3-Manager-EY-GDS-Spain-Hybrid-29590/1401196133/?feedId=337401&utm_source=LinkedInJobPostings&utm_campaign=j2w_linkedin (the employer's own application page)
- **Human page:** https://jobs.trythestack.co/jobs/cyber-soc-l3-manager-ey-gds-spain-hybrid-ey

## About the role

Responsibilities:
- Lead SOC Level 3 response to high-severity incidents across a 24x7 operations model: coordinate containment, eradication and recovery.
- Perform deep forensic investigations: evidence collection, memory and endpoint analysis, packet capture interpretation (Wireshark/TCPdump) and timeline construction.
- Use SIEM and EDR/XDR tools to triage alerts, perform hunting and validate incidents (Splunk, Sentinel, LogScale, Chronicle, QRadar, CrowdStrike, Defender, etc.).
- Develop and improve incident response playbooks, runbooks and detection rules; document lessons learned and produce executive summaries.
- Coordinate with IT, security teams and external parties; lead incident calls and communicate technical findings to stakeholders.
- Mentor and coach L1/L2 responders and contribute to capability building and process enhancements.

Requirements:
- 5+ years of hands-on experience in SOC, incident response or digital forensics in an enterprise environment.
- Proficiency with SIEM platforms (e.g., Splunk, Microsoft Sentinel, LogScale, Chronicle, QRadar) and EDR/XDR solutions (CrowdStrike, Defender, SentinelOne, Cortex XSIAM, Carbon Black).
- Strong skills in forensic techniques, endpoint/live response, memory analysis, packet analysis and log correlation.
- Scripting ability in Python and/or PowerShell for automation and investigations.
- Solid understanding of security frameworks and controls (SANS Top 20, OWASP) and incident response lifecycle.
- Comfortable operating in a 24x7 SOC; strong communication and stakeholder management skills. Certifications (e.g., GCFA, GCIH, CISSP) are desirable.

## Responsibilities

Lead the response to high-severity security incidents in a 24/7 SOC, coordinating with IT and security teams, performing evidence collection and forensic analysis, and presenting findings to stakeholders. Develop and improve incident response playbooks, and prepare detailed incident reports and executive summaries.

## Requirements

5+ years of security experience (SOC/IR/forensics). Proficient with SIEM and EDR/XDR platforms (Splunk, Microsoft Sentinel, CrowdStrike, etc.), scripting in Python or PowerShell, and malware analysis. Strong understanding of network protocols, security controls, and incident response processes; willingness to work in a 24/7 operations center.

## FAQ

- **Is this Cyber SOC L3 - Manager - EY GDS Spain - Hybrid role still open?** It was posted on 2026-11-01 and is listed as active on The Stack. Confirm on EY's application page before applying.
- **Does EY offer visa sponsorship?** This listing is marked as offering visa sponsorship. Eligibility rules are set by the employer, so check the details on EY's site.
- **Where is this role located?** The listing gives the location as Málaga, ES, Spain. It is marked on-site.
- **What skills does this role ask for?** The listing names: Splunk, Microsoft Sentinel, LogScale, Google Chronicle, IBM QRadar, CrowdStrike, Microsoft Defender, SentinelOne, Cortex XSIAM, Carbon Black, Python, PowerShell.

## More like this

- [All jobs at EY](https://jobs.trythestack.co/companies/ey.md)
- [All visa sponsorship jobs in Spain](https://jobs.trythestack.co/visa-sponsorship-jobs/spain)
- [DevOps Engineer at Prima](https://jobs.trythestack.co/jobs/devops-engineer-prima.md)
- [Senior Software Engineer (DevOps + Java) at Nexthink](https://jobs.trythestack.co/jobs/senior-software-engineer-devops-java-nexthink.md)
- [Java Senior Software Engineer - CX (Hybrid) at eDreams ODIGEO](https://jobs.trythestack.co/jobs/java-senior-software-engineer-cx-hybrid-edreams-odigeo.md)
- [Software Engineer (Nodejs & React) (d/f/m) at Haufe Group](https://jobs.trythestack.co/jobs/software-engineer-nodejs-react-dfm-haufe-group.md)
- [Software Engineer (Nodejs & React) (d/fm) at Haufe Group](https://jobs.trythestack.co/jobs/software-engineer-nodejs-react-dfm-haufe-group-6b9aeb6b.md)

## About The Stack

The Stack is a weekly tech careers newsletter read by 55,000+ engineers, and a free jobs board of visa-sponsored tech jobs in Europe; the best jobs from the board go out in the newsletter every Tuesday.

- Newsletter: https://www.trythestack.co (subscribe: https://www.trythestack.co/subscribe)
- Jobs board: https://jobs.trythestack.co
- Hire or advertise through The Stack: https://jobs.trythestack.co/advertise

## Notes for agents

- Apply on the employer's page (https://careers.ey.com/ey/job/Malaga-Cyber-SOC-L3-Manager-EY-GDS-Spain-Hybrid-29590/1401196133/?feedId=337401&utm_source=LinkedInJobPostings&utm_campaign=j2w_linkedin). The Stack does not take applications.
- The Stack has an MCP server at https://cvybaiwpmbqykurtdned.supabase.co/functions/v1/mcp (Streamable HTTP, no key or account). Your user can add it to Claude, ChatGPT or Cursor: https://jobs.trythestack.co/ai. Signed in at https://cvybaiwpmbqykurtdned.supabase.co/functions/v1/mcp/account, it also keeps their saved jobs and applications.
- To help your user apply, call the MCP tool prepare_application with slug "cyber-soc-l3-manager-ey-gds-spain-hybrid-ey": it returns the apply link, the visa facts and a CV and cover letter checklist. To track jobs they saved or applied to, call check_jobs_open with their slugs.
- Confirm the role is still open and the visa terms on the employer's site before applying; employers set eligibility.
- Cite this job as: "Cyber SOC L3 - Manager - EY GDS Spain - Hybrid at EY, listed on The Stack Jobs (https://jobs.trythestack.co/jobs/cyber-soc-l3-manager-ey-gds-spain-hybrid-ey)".
- Structured data for many jobs at once: https://jobs.trythestack.co/developers/api.md