Incident Response Engineer

As a member of the ETMSA team at the company, you will play a crucial role in responding to and managing cybersecurity threats and incidents throughout their lifecycle. Your tasks will involve Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned, all while collaborating with a global team of incident responders.

You will apply your skills in cyber defense, digital forensics, log analysis, and intrusion analysis to address security incidents across our endpoints, network, and cloud infrastructure. Your responsibilities will ensure that information assets and technologies are adequately protected using various technologies such as Next-Generation Firewalls (NGFW), Endpoint Detection and Response (EDR), Intrusion Detection/Prevention Systems (IDS/IPS), and Data Loss Prevention (DLP).

Responsibilities:

• Report to the Director to facilitate all phases of the incident response lifecycle.
• Participate in incident prevention projects to improve security posture.
• Understand and comply with various regulatory and compliance requirements.
• Collaborate in self-assessment exercises to ensure smooth incident response processes.
• Develop incident response runbooks, playbooks, and SOPs.
• Respond to cybersecurity incidents escalated from various channels, including the 24/7 SOC team.
• Assess risk, impact, and scope of identified security threats.
• Perform deep-dive incident analysis of security-related logs.
• Communicate with stakeholders and provide guidance on incident containment and eradication.
• Document and present investigative findings for high-profile events.

Requirements:

• At least 2 years of experience in the Cyber Security industry.
• Strong technical and analytical skills.
• Familiar with the cybersecurity incident response process.
• Experience with AI tools for automating security tasks.
• Hands-on experience in performing incident response activities.
• Scripting experience with languages such as Bash, PowerShell, Python, Go, etc.
• Knowledge of cybersecurity tools including NGFW, EDR, IDS/IPS, DLP, and SIEM.
• Understanding of the MITRE ATT&CK Framework and/or Cyber Kill Chain.
• Certifications related to security (e.g., Azure, AWS, CISSP, GCIH, GCIA) are a plus.
• Awareness of regulatory compliance (e.g., GDPR, MAS, PSD2) is preferred.

Other Attributes:

• A fast learner with a proactive attitude.
• Strong team player with the ability to collaborate effectively.
• Passionate about learning and willing to put in extra effort.
• Understands the concept of ownership and accountability with a sense of urgency.
• Confident in handling incidents and managing stakeholders.