Cyber Incident Response and Detection Specialist

Job Description

• Monitor, prioritize, and analyze cyber security incidents across both IT and OT environments from end to end.
• Lead end-to-end incident response actions against critical cyber threats, including malware infections, ransomware attacks, unauthorized access attempts, and data leaks, ensuring containment and mitigation.
• Perform digital forensics investigations on Windows/Linux operating systems and network devices; conduct Root Cause Analysis (RCA) and implement corrective/preventive actions.
• Utilize the MITRE ATT&CK Framework to analyze adversary tactics, techniques, and procedures (TTPs) to enhance proactive defense mechanisms.
• Conduct proactive Threat Hunting activities utilizing system and network logs to identify hidden threats and anomalous behaviors.
• Design, update, and optimize correlation rules, detection rules, and use cases on SIEM and EDR platforms to improve visibility and detection capabilities.
• Create and maintain Incident Response Playbooks, and coordinate with cross-functional teams to conduct Tabletop Exercises.
• Prepare comprehensive technical analysis reports, incident assessments, and threat briefs for both technical teams and senior management.
• Identify security gaps, develop remediation recommendations, and track their implementation in coordination with relevant infrastructure and application teams.

Qualifications

• Bachelor’s degree in Computer Engineering, Electrical-Electronics Engineering or related fields,
• Minimum 3 years of experience in Cyber Security Operations (SOC), Incident Response (IR), or Threat Hunting,
• Deep knowledge of Windows and Linux operating system architectures, with proven experience in Digital Forensics,
• Strong understanding of network security, TCP/IP protocols, network architectures, and traffic analysis,
• Proficiency in managing and analyzing data from core security solutions: EDR, SIEM, SOAR, Firewall, IPS/IDS, Sandbox, Packet Capture, and NDR,
• Hands-on scripting experience in Python, PowerShell, or Bash to build automation and response tools for security operations,
• Excellent command of English (both written and verbal) to collaborate with international teams and analyze global threat intelligence.