Security Engineer

Position: Security Engineer – Vulnerability Management, Detection & GenAI Security

Start date: ASAP

Duration: 3 to 6 months

Location: Geneva, Switzerland - hybride

Languages: fluent English; French a strong plus

Mission context

Our client, an international organisation based in Geneva, is strengthening its IT Security team. The consultant will clear the security backlog, run day-to-day security operations and act as a full backup for the current security engineer.

Roughly 45% of the time goes to backlog and operations, 30% to taking over the backup scope and 25% to securing generative AI deployments and the product lifecycle. The consultant is expected to run each backed-up service alone by the end of month 3, after co-running it at least once and documenting it in a runbook.

Key responsibilities

Vulnerability management: run the monthly scan cycle and patch-compliance reporting, lead the migration from Rapid7 InsightVM to CrowdStrike, triage vendor advisories and CVEs (Fortinet, Palo Alto, F5, Cisco, Okta, AWS) and track end-of-life assets.
Detection and endpoint: support the CrowdStrike tenant migration and the retirement of Cortex XDR, onboard log sources and build detections in CrowdStrike Next-Gen SIEM, and act as second-line responder on security incidents.
Network and certificates: apply Fortinet and Palo Alto hardening releases, review firewall rule sets and deliver the 47-day TLS certificate programme (inventory, DCV automation, internal PKI audit).
Remediation: own the tracking of penetration test and red team findings from ticket to retest, and take over agreed backlog items such as AWS guardrails (SCP library) and the security playbook framework.
GenAI security: triage new AI platforms and use cases, threat-model GenAI and agentic deployments against the OWASP Top 10 for LLM Applications, and define guardrails before go-live (access, data classification, rate limiting, logging).
Secure product lifecycle: represent IT Security in transformation workstreams, embed security checkpoints at each stage (threat model, sign-off before launch, secure decommissioning) and provide reusable requirements and checklists.
Documentation and reporting: keep runbooks, security plans and the team’s Confluence space up to date, and feed weekly status reporting to the CISO.

Required profile

5+ years in hands-on security engineering or security operations, including at least 2 in a mid-to-large enterprise.
End-to-end vulnerability management experience: scanning, prioritisation by exploitability (CISA KEV, EPSS), patch tracking and reporting.
Operational experience with CrowdStrike Falcon (EDR and Next-Gen SIEM) or an equivalent EDR/SIEM stack.
Working knowledge of next-generation firewalls (ideally Fortinet and/or Palo Alto), TLS/PKI and certificate management.
AWS security fundamentals: IAM, SCPs, security groups and CSPM findings (Wiz or similar).
Has secured at least one production GenAI or LLM-based deployment, including threat modelling and guardrail design.
Experience in a product or SDLC delivery model, providing security requirements and sign-off at stage gates.
Writes clear runbooks and drives remediation through other teams without direct authority.
Fluent English; French a strong plus.

Nice to have

Certifications: CISSP or CCSP, GIAC (GCIH, GCIA, GEVA) or CompTIA CySA+, CrowdStrike CCFA/CCFR, AWS Security Specialty, Fortinet NSE 4+.
Experience migrating between vulnerability management or EDR platforms.
Familiarity with F5 BIG-IP, Akamai WAF, Okta, WALLIX PAM, ServiceNow and Jira/Confluence.
Python scripting to automate scanning, reporting or certificate workflows.
Exposure to ISO 27001, NIST CSF 2.0 or the Swiss nFADP.
Knowledge of ISO/IEC 42001, the NIST AI RMF or the EU AI Act; AI security training (e.g. SANS SEC545, IAPP AIGP).
Experience with MuleSoft, Databricks, AWS Bedrock or similar AI platforms.
Experience in an international organisation or a high-visibility environment.