Cyber Security Incident Response Team

pAt MindWave, we’re not just building teams. We’re building a new way of working. We’re creating a community of experts who thrive in a transparent, human, and forward-thinking environment.br/ /ppWe are currently looking for a bCyber Security Incident Response Team (CSIRT) Officer /b to join our community and support a major CISO Cybersecurity Center of Excellence team. In this role, you will contribute to daily security incident preparation, detection, and response activities—including threat detection, level 3/4 incident handling, forensic analysis, threat hunting, and SIEM engineering—while working closely with internal staff, affiliates, and external security service providers. /ph3Key Responsibilities /h3ulliInvestigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments. /liliConduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin. /liliWork closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks. /liliDevelop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization. /liliClearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders. /li /ulh31. Incident Handling Level 3/4 Response /h3ulliInvestigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments. /liliConduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin. /liliWork closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks. /liliDevelop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization. /liliClearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders. /li /ulh32. Threat Detection Threat Hunting /h3ulliProactively identify threats and vulnerabilities across the organization's infrastructure using SIEM platforms and custom detection tools. /liliConduct regular threat hunting exercises to detect potential threats that have evaded traditional security controls. /liliCollect and analyze security data and system artifacts (analyzing Windows, Linux, network, and security logs) to identify anomalous behavior and indicators of compromise (IOCs). /liliCollaborate closely with the 3rd party SOC team to investigate potential security incidents and provide technical guidance on threat remediation and mitigation strategies. /li /ulh33. SIEM Engineering Automation /h3ulliDevelop, maintain, and optimize SIEM systems (e.g., Microsoft Sentinel) to ensure timely detection and rapid incident response. /liliCreate, refine, and maintain custom detection rules and use cases aligned with the bMITRE ATTCK /b framework. /liliAuthor and maintain detailed playbooks for the SOC team to ensure standardized, consistent, and effective incident response. /liliAutomate alert handling and response workflows for SIEM and EDR events to streamline security operations and allow the SOC/CSIRT to focus on high-priority threats. /li /ulh34. Projects, Exercises Continuous Improvement /h3ulliOrganize, animate, and facilitate cybersecurity tabletop exercises to test organizational incident response readiness. /liliContribute to security engineering projects based on team needs, such as deploying, maintaining, and integrating new security platforms or tools. /liliScript and automate manual operational tasks to enhance the team's efficiency and detection capabilities. /li /ulh3Team Context /h3pYou will join the CISO Cybersecurity Center of Excellence team within the enterprise CISO organization. You will collaborate closely with fellow CSIRT officers, internal IT/OT/IoT teams, the 3rd party Security Operations Center (SOC) team, organizational affiliates, and external security service providers. /ph3Conformity Qualification Criteria /h3ullibEducation: /b Bachelor's degree in Computer Science, Information Security, a related field, or equivalent professional experience. /lilibExperience: /b Minimum 4 years of professional experience in a security-related role, with a strong focus on incident response and technical security analysis. /lilibTabletop Exercises: /b Demonstrated experience in organizing, planning, and animating tabletop exercises. /lilibCertifications: /b Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, GREM, or equivalent. /lilibLanguage Proficiency: /b Spoken and written fluency in English (minimum C1 level). Working knowledge of Dutch (NL) or French (FR) is an asset. /lilibLocation Presence: /b Hybrid s