Vehicle Security Operations Engineer

About the Role

On behalf of a leading global automotive OEM, we are looking for a Vehicle Security Operations Engineer to join its European R&D organization in Barcelona.

This role is responsible for the local cybersecurity operations of connected vehicles, cloud platforms and backend services across the European market. You will monitor and investigate security events, optimize detection capabilities and coordinate with global headquarters, European teams and external partners to ensure incidents are handled effectively and brought to full closure.

Key Responsibilities

• Perform cybersecurity monitoring and security operations for connected vehicles, cloud platforms and backend services in Europe.

• Monitor abnormal cybersecurity behaviours, attack patterns and potential threats, identifying and investigating vehicle-related alerts and incidents.

• Conduct alert triage, incident investigation, root-cause analysis and follow-up actions, driving identified issues through to effective closure.

• Develop, maintain and optimize SIEM/IDS detection rules, correlation rules and vehicle-security use cases.

• Improve VSOC detection coverage, incident-response playbooks, monitoring processes and security automation capabilities.

• Support proactive threat hunting, vulnerability analysis and continuous improvement of security monitoring.

• Establish local processes, operating standards and reporting mechanisms for European vehicle cybersecurity operations.

• Support the secure and compliant operation of connected vehicle services in accordance with ISO/SAE 21434, UNECE R155/R156, GDPR and other relevant European requirements.

• Collaborate with headquarters, European engineering teams, Product, Quality, Aftersales, Operations, Tier 1 suppliers and technical service providers.

• Prepare incident reports, technical analyses, operational records and decision-support materials.

Requirements

• Bachelor’s degree or above in Computer Science, Cybersecurity, Communications Engineering or a related field.

• At least 3 years of professional experience in cybersecurity operations, SOC, incident response, detection engineering or a closely related area.

• Hands-on experience with SIEM, IDS or other security-monitoring and threat-detection platforms.

• Experience in security alert analysis, incident investigation, vulnerability analysis, threat hunting or response playbook development.

• Ability to manage the complete issue lifecycle, from identification and escalation through investigation, remediation, verification and closure.

• Automotive cybersecurity, connected vehicle, telematics, IoT, OEM or Tier 1 experience is strongly preferred.

• Knowledge of ISO/SAE 21434, UNECE R155/R156, CSMS, GDPR or European connected vehicle regulations is highly desirable.

• Experience supporting the overseas implementation or operation of connected vehicle services is preferred.

• English must both be usable as working languages.

• Spanish or another European language is an advantage.

• Strong cross-functional and cross-cultural communication skills, with the ability to coordinate effectively between global headquarters and European local teams.

• Willingness to undertake occasional business travel.

Preferred Backgrounds

We particularly welcome candidates with experience in Vehicle SOC/VSOC, Automotive CSIRT or PSIRT, connected vehicle security operations, automotive incident response, detection engineering or automotive cloud security.