Cyber Security Incident Response Team

At MindWave, we’re not just building teams. We’re building a new way of working. We’re creating a community of experts who thrive in a transparent, human, and forward-thinking environment.

We are currently looking for a Cyber Security Incident Response Team (CSIRT) Officer to join our community and support a major CISO Cybersecurity Center of Excellence team. In this role, you will contribute to daily security incident preparation, detection, and response activities—including threat detection, level 3/4 incident handling, forensic analysis, threat hunting, and SIEM engineering—while working closely with internal staff, affiliates, and external security service providers.

Key Responsibilities

• Investigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments.
• Conduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin.
• Work closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks.
• Develop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization.
• Clearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders.

1. Incident Handling & Level 3/4 Response

• Investigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments.
• Conduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin.
• Work closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks.
• Develop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization.
• Clearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders.

2. Threat Detection & Threat Hunting

• Proactively identify threats and vulnerabilities across the organization's infrastructure using SIEM platforms and custom detection tools.
• Conduct regular threat hunting exercises to detect potential threats that have evaded traditional security controls.
• Collect and analyze security data and system artifacts (analyzing Windows, Linux, network, and security logs) to identify anomalous behavior and indicators of compromise (IOCs).
• Collaborate closely with the 3rd party SOC team to investigate potential security incidents and provide technical guidance on threat remediation and mitigation strategies.

3. SIEM Engineering & Automation

• Develop, maintain, and optimize SIEM systems (e.g., Microsoft Sentinel) to ensure timely detection and rapid incident response.
• Create, refine, and maintain custom detection rules and use cases aligned with the MITRE ATT&CK framework.
• Author and maintain detailed playbooks for the SOC team to ensure standardized, consistent, and effective incident response.
• Automate alert handling and response workflows for SIEM and EDR events to streamline security operations and allow the SOC/CSIRT to focus on high-priority threats.

4. Projects, Exercises & Continuous Improvement

• Organize, animate, and facilitate cybersecurity tabletop exercises to test organizational incident response readiness.
• Contribute to security engineering projects based on team needs, such as deploying, maintaining, and integrating new security platforms or tools.
• Script and automate manual operational tasks to enhance the team's efficiency and detection capabilities.

Team Context

You will join the CISO Cybersecurity Center of Excellence team within the enterprise CISO organization. You will collaborate closely with fellow CSIRT officers, internal IT/OT/IoT teams, the 3rd party Security Operations Center (SOC) team, organizational affiliates, and external security service providers.

Conformity & Qualification Criteria

• Education: Bachelor's degree in Computer Science, Information Security, a related field, or equivalent professional experience.
• Experience: Minimum 4 years of professional experience in a security-related role, with a strong focus on incident response and technical security analysis.
• Tabletop Exercises: Demonstrated experience in organizing, planning, and animating tabletop exercises.
• Certifications: Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, GREM, or equivalent.
• Language Proficiency: Sp