Responsibilities:
 
Investigate and respond to security incidents across network, endpoint, email, and cloud environments to ensure timely containment, eradication, and recovery.
Conduct in-depth analysis by correlating events, alerts, and logs from tools such as SIEMs, EDRs, and firewalls to identify suspicious or malicious activity.
Develop, maintain, and execute incident response playbooks to ensure consistent, effective, and repeatable handling of security threats.
Perform deep-dive investigations to determine the root cause of security incidents and ensure accurate documentation of findings.
Collaborate with internal teams including threat intelligence, detection engineering, and infrastructure to ensure coordinated and comprehensive incident resolution.
Analyze indicators of compromise (IOCs) and attacker techniques post-incident to improve detection, prevention, and response capabilities.
Assist in post-incident reviews and reporting to identify process gaps, drive improvements, and strengthen overall incident response posture.
Prepare and deliver reports to senior leadership as needed, covering playbook usage, root cause analysis, standard procedures, and remediation outcomes.
Facilitate effective communication with stakeholders during and after security incidents to ensure alignment, transparency, and clarity.
Stay up to date on the latest cybersecurity threats, vulnerabilities, and attacker trends to continuously improve detection and response strategies.
 
Qualifications:
 
Proficient in Incident Management, Detection and Response.
Extensive knowledge on network, endpoint, threat intelligence, as well as the functioning of specific applications or underlying IT infrastructure.
Understanding of possible attack activities such as network, phishing, scanning, DDOS, malicious code activity etc.
Threat Hunting Understanding of attacker techniques that leverage email and cloud-service tactics.
Experience dealing with advanced persistent threats (APTs) and human adversary compromises.
Should have knowledge to identify potential risks, threats, vulnerabilities and exploits through malware analysis vulnerability scanning, threat hunting, secure code review and penetration testing.
Ability to document findings accurately and drive remediation validation of identified vulnerabilities.
Expertise in creating and executing Incident Response Playbooks.
Excellent communication skills to coordinate among various stakeholders of the organization.
Proficiency in visibility and detection in cloud environments.
Should have expertise on Sentinel and KQL language.
Enthusiastic and motivated to learn new processes and tools.
Knowledge of detailed understanding the background of the event that occurred.
 
Mental Requirements:
 
Demonstrated ability to achieve objectives with little oversight and effectively prioritize tasks in a high-pressure dynamic environment
Demonstrated analytical and problem-solving abilities, keen attention to detail
Experience and demonstrated success working in a global team-oriented, collaborative, virtual environment.
Strong security mindset
Demonstrate the ability to analyze and determine root cause, develop remediation plans, and implement them.
Demonstrated interpersonal, written, and verbal communication skills
Demonstrated ability to present ideas in user-friendly language.
Aptitude to learn new skills and technologies to meet changing needs
Ability to peer review technical documentation prepared by colleagues
Ability to identify areas for improvement and be an ambassador for change.