Cyber Security Incident Response Team

Job Responsibilities

• Investigate and respond to level 3/4 security incidents, including malware infections, network intrusions, and data breaches.
• Conduct forensic investigations, coordination, and analysis of security incidents, regardless of IT, IoT, or OT origin.
• Work closely with other members of the SOC, CSIRT, and other teams within the organization to identify and mitigate security risks.
• Develop and implement incident response plans and procedures, and provide guidance to other members of the organization on security best practices.
• Communicate and report security incident progress to required internal and external stakeholders.
• Proactively identify threats and vulnerabilities within the organization’s infrastructure using SIEM and custom detection tools.
• Conduct regular threat hunting exercises to detect potential threats that may have evaded traditional security controls.
• Use various tools and techniques to collect and analyze security data, identify anomalous behavior, and detect potential indicators of compromise.
• Work closely with the third-party SOC team to investigate potential security incidents and provide guidance on threat remediation and mitigation strategies.
• Read and understand logs from Windows, Linux, network systems, and other sources to analyze system artifacts for signs of compromise.
• Develop, maintain, and optimize SIEM systems to ensure timely detection and response to security incidents.
• Create and maintain SIEM use cases and detection rules based on the MITRE ATT&CK framework.
• Write playbooks for the SOC team to ensure consistent and effective incident response.
• Automate responses to SIEM and EDR events as much as possible, enabling the SOC and CSIRT to focus on critical activities.
• Contribute to team projects, including rolling out and maintaining new security products or platforms and automating manual tasks using scripts.
• Organize and facilitate tabletop exercises.
• Interact professionally with internal staff, affiliates, and security service providers in an organization-sensitive manner.

Must Have Skills

• Bachelor’s degree in Computer Science, Information Security, a related field, or equivalent practical experience.
• At least 4 years of experience in a security-related role, with a strong focus on incident response and security analysis.
• Hands-on experience investigating and responding to security incidents, including malware infections, network intrusions, and data breaches.
• Experience with digital forensics, incident response, security monitoring, and threat intelligence.
• Strong knowledge of security technologies and tools, including SIEM, EDR, intrusion detection and prevention systems, and firewalls.
• Experience with Microsoft Sentinel SIEM, Microsoft Defender, and EDR solutions.
• Ability to read and analyze Windows, Linux, and network logs and system artifacts for indicators of compromise.
• Experience with threat hunting and investigating suspicious activities across networks and systems.
• Experience with SOC engineering, identifying detection gaps, and automating alert handling.
• Experience with security incident response tools, including ServiceNow SIR.
• Experience with forensic and/or malware analysis techniques.
• Experience organizing and facilitating tabletop exercises.
• Knowledge of the MITRE ATT&CK framework and ability to develop detection rules and use cases.
• Strong analytical and problem-solving skills, with the ability to respond to incidents in a timely and effective manner.
• Excellent customer focus and ability to handle sensitive organizational situations.
• Fluent spoken and written English, minimum C1 level.

Nice to have

• Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, or GREM.
• Working knowledge of French or Dutch.
• Experience working in complex, multi-stakeholder enterprise environments.
• Knowledge of IT, IoT, and OT security environments.
• Experience with security automation, scripting, and workflow orchestration.
• Experience developing incident response playbooks and improving SOC detection capabilities.
• Experience supporting security projects, including platform rollouts, maintenance, and automation initiatives.
• Familiarity with railway, public transport, or critical infrastructure IT ecosystems.

What’s great in the job? Great team of smart people, in a friendly and open culture No waste of time in enterprise processes, real responsibilities and autonomy Expand your knowledge of various business industries Create content that will help our users on a daily basis Real responsibilities and challenges in a fast evolving company