Cyber Security Incident Response Team (CSIRT) Officer
Job Details
Hiring Process
Time to Answer
2 open days
Process
1 Phone Call
1 Onsite Interview
Days to get an Offer
4 Days after Interview
Overview
We are looking for an experienced Cyber Security Incident Response Team (CSIRT) Officer to join a Cybersecurity Center of Excellence team. The successful candidate will support daily security incident preparation, detection, and response activities, including incident handling, forensic investigations, threat detection, threat hunting, SIEM engineering, and security automation. The role requires close collaboration with internal teams, SOC analysts, security service providers, and business stakeholders to identify, investigate, contain, and remediate cybersecurity incidents across IT, IoT, and OT environments.
Job Responsibilities
- Investigate and respond to level 3/4 security incidents, including malware infections, network intrusions, and data breaches.
- Conduct forensic investigations, coordination, and analysis of security incidents, regardless of IT, IoT, or OT origin.
- Work closely with other members of the SOC, CSIRT, and other teams within the organization to identify and mitigate security risks.
- Develop and implement incident response plans and procedures, and provide guidance to other members of the organization on security best practices.
- Communicate and report security incident progress to required internal and external stakeholders.
- Proactively identify threats and vulnerabilities within the organization’s infrastructure using SIEM and custom detection tools.
- Conduct regular threat hunting exercises to detect potential threats that may have evaded traditional security controls.
- Use various tools and techniques to collect and analyze security data, identify anomalous behavior, and detect potential indicators of compromise.
- Work closely with the third-party SOC team to investigate potential security incidents and provide guidance on threat remediation and mitigation strategies.
- Read and understand logs from Windows, Linux, network systems, and other sources to analyze system artifacts for signs of compromise.
- Develop, maintain, and optimize SIEM systems to ensure timely detection and response to security incidents.
- Create and maintain SIEM use cases and detection rules based on the MITRE ATT&CK framework.
- Write playbooks for the SOC team to ensure consistent and effective incident response.
- Automate responses to SIEM and EDR events as much as possible, enabling the SOC and CSIRT to focus on critical activities.
- Contribute to team projects, including rolling out and maintaining new security products or platforms and automating manual tasks using scripts.
- Organize and facilitate tabletop exercises.
- Interact professionally with internal staff, affiliates, and security service providers in an organization-sensitive manner.
Must Have Skills
- Bachelor’s degree in Computer Science, Information Security, a related field, or equivalent practical experience.
- At least 4 years of experience in a security-related role, with a strong focus on incident response and security analysis.
- Hands-on experience investigating and responding to security incidents, including malware infections, network intrusions, and data breaches.
- Experience with digital forensics, incident response, security monitoring, and threat intelligence.
- Strong knowledge of security technologies and tools, including SIEM, EDR, intrusion detection and prevention systems, and firewalls.
- Experience with Microsoft Sentinel SIEM, Microsoft Defender, and EDR solutions.
- Ability to read and analyze Windows, Linux, and network logs and system artifacts for indicators of compromise.
- Experience with threat hunting and investigating suspicious activities across networks and systems.
- Experience with SOC engineering, identifying detection gaps, and automating alert handling.
- Experience with security incident response tools, including ServiceNow SIR.
- Experience with forensic and/or malware analysis techniques.
- Experience organizing and facilitating tabletop exercises.
- Knowledge of the MITRE ATT&CK framework and ability to develop detection rules and use cases.
- Strong analytical and problem-solving skills, with the ability to respond to incidents in a timely and effective manner.
- Excellent customer focus and ability to handle sensitive organizational situations.
- Fluent spoken and written English, minimum C1 level.
Nice to have
- Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, or GREM.
- Working knowledge of French or Dutch.
- Experience working in complex, multi-stakeholder enterprise environments.
- Knowledge of IT, IoT, and OT security environments.
- Experience with security automation, scripting, and workflow orchestration.
- Experience developing incident response playbooks and improving SOC detection capabilities.
- Experience supporting security projects, including platform rollouts, maintenance, and automation initiatives.
- Familiarity with railway, public transport, or critical infrastructure IT ecosystems.
What's great in the job?
- Great team of smart people, in a friendly and open culture
- No waste of time in enterprise processes, real responsibilities and autonomy
- Expand your knowledge of various business industries
- Create content that will help our users on a daily basis
- Real responsibilities and challenges in a fast evolving company
Travailler chez yechte
Nous sommes un cabinet de conseil numérique indépendant avec des objectifs ambitieux et une présence mondiale. Nous accompagnons un large éventail d'entreprises, en constituant des équipes numériques et en fournissant des solutions numériques innovantes. Notre personnel multiculturel et diversifié, composé de « citoyens du monde », reflète cette inclusivité.
Nous accordons une grande importance à l'équilibre entre vie professionnelle et vie privée et nous nous efforçons de répondre aux attentes d'une équipe en pleine croissance, en investissant dans les personnes, car elles constituent notre plus grand atout. Notre croissance constante témoigne de cet engagement.
Venez travailler chez yechte, une entreprise en pleine expansion qui offre d'excellents avantages sociaux, des opportunités de développement personnel et la possibilité d'apprendre auprès de leaders accomplis. Nous sommes toujours à la recherche de professionnels exceptionnels pour rejoindre notre équipe.
Ce que nous offrons
Chaque employé a la possibilité de voir l'impact de son travail. Vous travaillez sur de véritables projets numériques et apportez une contribution tangible à l'entreprise. Nous voulons offrir à chacun la possibilité de s'épanouir sur le plan personnel, professionnel et social.
Flexibilité
Votre bien-être nous tient à cœur. Chez yechte, nous proposons des horaires flexibles et des modalités de travail hybrides à domicile/au bureau, améliorant ainsi l'équilibre entre vie professionnelle et vie privée et la productivité des employés.
Avantages attractifs
Votre confort nous tient à cœur. Chez yechte, nous proposons des plans de mobilité économiques et écologiques, des indemnités alimentaires et une couverture santé complète, afin d'améliorer la satisfaction de nos employés.
Développement personnel
Votre épanouissement nous tient à cœur. Chez yechte, nous vous proposons de stimuler votre développement personnel grâce à des formations et des certifications informatiques sur mesure, favorisant une culture d'agilité et d'expertise technologique.
