Lead and Oversee Incident Response : Supervise formal incident response tasks, ensure successful execution of the response plan, and manage audit issue resolution related to incident management.
Coordinate and Communicate Across Teams : Interface with CSIRT and cross-functional teams to design cohesive responses, build effective relationships, and continuously improve the global incident response function.
Investigate and Analyze Incidents : Conduct technical cybersecurity investigations, perform root cause analysis, resolve complex incidents, and serve as a global escalation point for unresolved L1/L2 cases.
Enhance Processes and Controls : Mature the incident response process to align with global business needs, refine runbooks, and provide recommendations for security control improvements based on incident data.
Data-Driven Threat Detection : Analyze large, unstructured datasets to identify malicious trends and anomalies, while guiding and prioritizing tasks for L1/L2 analysts.
Essential Requirements
8+ years of hands-on experience in systems and networking, with at least 5 years specifically in cybersecurity incident response.
Holds one or more relevant certifications such as CISSP, GCIH, GCIA, GNFA, or GREM.
Deep knowledge of security technologies (e.g., SIEM, EDR, IDS/IPS, DLP, UEBA), web technologies, networking protocols, and both Windows and Linux/Unix environments.
Proven ability to conduct thorough investigations, identify root causes, and understand various cyber-attack techniques, incident response, and threat hunting lifecycles.
Hands-on experience with scripting and automation using Python, PowerShell, Bash, etc., along with strong analytical, coordination, and English communication skills.