Cyber Security Incident Response Team

h3Job Responsibilities /h3ulliInvestigate and respond to level 3/4 security incidents, including malware infections, network intrusions, and data breaches. /liliConduct forensic investigations, coordination, and analysis of security incidents, regardless of IT, IoT, or OT origin. /liliWork closely with other members of the SOC, CSIRT, and other teams within the organization to identify and mitigate security risks. /liliDevelop and implement incident response plans and procedures, and provide guidance to other members of the organization on security best practices. /liliCommunicate and report security incident progress to required internal and external stakeholders. /liliProactively identify threats and vulnerabilities within the organization’s infrastructure using SIEM and custom detection tools. /liliConduct regular threat hunting exercises to detect potential threats that may have evaded traditional security controls. /liliUse various tools and techniques to collect and analyze security data, identify anomalous behavior, and detect potential indicators of compromise. /liliWork closely with the third-party SOC team to investigate potential security incidents and provide guidance on threat remediation and mitigation strategies. /liliRead and understand logs from Windows, Linux, network systems, and other sources to analyze system artifacts for signs of compromise. /liliDevelop, maintain, and optimize SIEM systems to ensure timely detection and response to security incidents. /liliCreate and maintain SIEM use cases and detection rules based on the MITRE ATTCK framework. /liliWrite playbooks for the SOC team to ensure consistent and effective incident response. /liliAutomate responses to SIEM and EDR events as much as possible, enabling the SOC and CSIRT to focus on critical activities. /liliContribute to team projects, including rolling out and maintaining new security products or platforms and automating manual tasks using scripts. /liliOrganize and facilitate tabletop exercises. /liliInteract professionally with internal staff, affiliates, and security service providers in an organization-sensitive manner. /li /ulh3Must Have Skills /h3ulliBachelor’s degree in Computer Science, Information Security, a related field, or equivalent practical experience. /liliAt least 4 years of experience in a security-related role, with a strong focus on incident response and security analysis. /liliHands-on experience investigating and responding to security incidents, including malware infections, network intrusions, and data breaches. /liliExperience with digital forensics, incident response, security monitoring, and threat intelligence. /liliStrong knowledge of security technologies and tools, including SIEM, EDR, intrusion detection and prevention systems, and firewalls. /liliExperience with Microsoft Sentinel SIEM, Microsoft Defender, and EDR solutions. /liliAbility to read and analyze Windows, Linux, and network logs and system artifacts for indicators of compromise. /liliExperience with threat hunting and investigating suspicious activities across networks and systems. /liliExperience with SOC engineering, identifying detection gaps, and automating alert handling. /liliExperience with security incident response tools, including ServiceNow SIR. /liliExperience with forensic and/or malware analysis techniques. /liliExperience organizing and facilitating tabletop exercises. /liliKnowledge of the MITRE ATTCK framework and ability to develop detection rules and use cases. /liliStrong analytical and problem-solving skills, with the ability to respond to incidents in a timely and effective manner. /liliExcellent customer focus and ability to handle sensitive organizational situations. /liliFluent spoken and written English, minimum C1 level. /li /ulh3Nice to have /h3ulliRelevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, or GREM. /liliWorking knowledge of French or Dutch. /liliExperience working in complex, multi-stakeholder enterprise environments. /liliKnowledge of IT, IoT, and OT security environments. /liliExperience with security automation, scripting, and workflow orchestration. /liliExperience developing incident response playbooks and improving SOC detection capabilities. /liliExperience supporting security projects, including platform rollouts, maintenance, and automation initiatives. /liliFamiliarity with railway, public transport, or critical infrastructure IT ecosystems. /li /ulpWhat’s great in the job? Great team of smart people, in a friendly and open culture No waste of time in enterprise processes, real responsibilities and autonomy Expand your knowledge of various business industries Create content that will help our users on a daily basis Real responsibilities and challenges in a fast evolving company /p