Cyber Security Incident Response Team (CSIRT) Officer
Job Details
Hiring Process
Time to Answer
2 open days
Process
1 Phone Call
1 Onsite Interview
Days to get an Offer
4 Days after Interview
Overview
We are looking for an experienced Cyber Security Incident Response Team (CSIRT) Officer to join a Cybersecurity Center of Excellence team. The successful candidate will support daily security incident preparation, detection, and response activities, including incident handling, forensic investigations, threat detection, threat hunting, SIEM engineering, and security automation. The role requires close collaboration with internal teams, SOC analysts, security service providers, and business stakeholders to identify, investigate, contain, and remediate cybersecurity incidents across IT, IoT, and OT environments.
Job Responsibilities
- Investigate and respond to level 3/4 security incidents, including malware infections, network intrusions, and data breaches.
- Conduct forensic investigations, coordination, and analysis of security incidents, regardless of IT, IoT, or OT origin.
- Work closely with other members of the SOC, CSIRT, and other teams within the organization to identify and mitigate security risks.
- Develop and implement incident response plans and procedures, and provide guidance to other members of the organization on security best practices.
- Communicate and report security incident progress to required internal and external stakeholders.
- Proactively identify threats and vulnerabilities within the organization’s infrastructure using SIEM and custom detection tools.
- Conduct regular threat hunting exercises to detect potential threats that may have evaded traditional security controls.
- Use various tools and techniques to collect and analyze security data, identify anomalous behavior, and detect potential indicators of compromise.
- Work closely with the third-party SOC team to investigate potential security incidents and provide guidance on threat remediation and mitigation strategies.
- Read and understand logs from Windows, Linux, network systems, and other sources to analyze system artifacts for signs of compromise.
- Develop, maintain, and optimize SIEM systems to ensure timely detection and response to security incidents.
- Create and maintain SIEM use cases and detection rules based on the MITRE ATT&CK framework.
- Write playbooks for the SOC team to ensure consistent and effective incident response.
- Automate responses to SIEM and EDR events as much as possible, enabling the SOC and CSIRT to focus on critical activities.
- Contribute to team projects, including rolling out and maintaining new security products or platforms and automating manual tasks using scripts.
- Organize and facilitate tabletop exercises.
- Interact professionally with internal staff, affiliates, and security service providers in an organization-sensitive manner.
Must Have Skills
- Bachelor’s degree in Computer Science, Information Security, a related field, or equivalent practical experience.
- At least 4 years of experience in a security-related role, with a strong focus on incident response and security analysis.
- Hands-on experience investigating and responding to security incidents, including malware infections, network intrusions, and data breaches.
- Experience with digital forensics, incident response, security monitoring, and threat intelligence.
- Strong knowledge of security technologies and tools, including SIEM, EDR, intrusion detection and prevention systems, and firewalls.
- Experience with Microsoft Sentinel SIEM, Microsoft Defender, and EDR solutions.
- Ability to read and analyze Windows, Linux, and network logs and system artifacts for indicators of compromise.
- Experience with threat hunting and investigating suspicious activities across networks and systems.
- Experience with SOC engineering, identifying detection gaps, and automating alert handling.
- Experience with security incident response tools, including ServiceNow SIR.
- Experience with forensic and/or malware analysis techniques.
- Experience organizing and facilitating tabletop exercises.
- Knowledge of the MITRE ATT&CK framework and ability to develop detection rules and use cases.
- Strong analytical and problem-solving skills, with the ability to respond to incidents in a timely and effective manner.
- Excellent customer focus and ability to handle sensitive organizational situations.
- Fluent spoken and written English, minimum C1 level.
Nice to have
- Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, or GREM.
- Working knowledge of French or Dutch.
- Experience working in complex, multi-stakeholder enterprise environments.
- Knowledge of IT, IoT, and OT security environments.
- Experience with security automation, scripting, and workflow orchestration.
- Experience developing incident response playbooks and improving SOC detection capabilities.
- Experience supporting security projects, including platform rollouts, maintenance, and automation initiatives.
- Familiarity with railway, public transport, or critical infrastructure IT ecosystems.
What's great in the job?
- Great team of smart people, in a friendly and open culture
- No waste of time in enterprise processes, real responsibilities and autonomy
- Expand your knowledge of various business industries
- Create content that will help our users on a daily basis
- Real responsibilities and challenges in a fast evolving company
Work at yechte
We are an independent digital consultancy with ambitious goals and a global presence. We support a diverse range of companies, building digital teams and delivering innovative digital solutions. Our multicultural and diverse workforce, comprised of ‘Global Citizens’, reflects this inclusivity.
We care about work-life balance and meeting the expectation of a growing team, investing in people because they are our greatest asset. Our consistent growth is a testament to this commitment.
Come work at yechte, a company on the rise, offering excellent benefits, opportunities for personal development, and the chance to learn from accomplished leaders. We are always looking for exceptional professionals to join our team.
What We Offer
Each employee has a chance to see the impact of his work. You work on real digital projects and make tangible contributions to the company. We want to provide to each individual personal, professional and social growth.
Flexibility
We care about your wellbeing. At yechte we offer flexi-hours and hybrid home/office work arrangements, enhancing employee work-life balance and productivity.
Attractive Benefits
We care about your comfort. At yechte we offer cost-effective and eco-friendly mobility plans, food allowances, and comprehensive healthcare support, enhancing employee satisfaction.
Personal Development
We care about your growth. At yechte we offer to boost your personal growth through tailored IT trainings and certifications, fostering a culture of agility and tech-driven expertise.
