Cyber Security Services Senior Incident Response Analyst

Stefanini Group is seeking a skilled Cyber Security Services (CSS) Seniorr Incident Response (IR) Analyst to join our Security Operations Center. As a CSS Sr. IR Analyst, you will manage security incidents, develop incident response processes, and enhance security configurations tailored to client needs. Your expertise will be crucial in reducing false positives and identifying security gaps within the client's IT infrastructure. Work Schedule: Two rotating 8.5-hour shifts within the 8:00 a.m.-8:00 p.m. EET coverage window. Job responsibilities
* Own assigned security alerts, incidents, and escalated tickets by conducting triage, cross-source investigations, and response activities across endpoints, identities, email, networks, cloud environments, and other relevant data sources using available security telemetry and investigation platforms.
* Analyze endpoint activity to identify indicators of compromise and adversary behaviors, including malicious execution, persistence, privilege escalation, and lateral movement.
* Investigate suspicious user and identity activity by analyzing Microsoft Entra ID authentication logs, sign-in activity, access patterns, anomalies, and other identity-related telemetry.
* Use SentinelOne Singularity Data Lake and SDL PowerQuery to perform advanced searches, correlate events, analyze threats, and support security investigations.
* Develop and validate investigation hypotheses using structured incident response, threat hunting, and forensic analysis methodologies.
* Execute containment, eradication, and recovery activities while coordinating with relevant technology owners and stakeholders to validate findings, contain threats, and restore affected services in accordance with approved incident response procedures and playbooks.
* Document investigative actions, evidence, analysis, decisions, communications, containment measures, and recovery activities throughout the incident lifecycle.
* Prepare detailed P1 and P2 incident reports covering the incident timeline, root cause, impact assessment, actions taken, current status, and lessons learned.
* Provide metrics and analysis on mean time to acknowledge, investigate, and resolve incidents by severity and lifecycle stage.
* Provide feedback on detection logic, alert quality, false positives, telemetry gaps, and monitoring improvement, recommending rule-tuning adjustments and new detection use cases based on emerging threats, vulnerabilities, observed activity, and attack patterns.
* Produce weekly operational reports on alert volumes and status, operational trends, investigation outcomes, false-positive rates by detection source.
* Participate in security operations meetings and present incident findings, operational trends, detection performance, service-level results, and improvement recommendations.
* Identify security gaps, recommend mitigation measures, and support SOAR automation workflows by providing operational feedback and identifying suitable automation opportunities to enhance operational efficiency.
* Contribute to the development, maintenance, and refinement of standard operating procedures, incident response playbooks, investigation guides, workflows, and process documentation.
* Support monthly security tool and log-source health checks by validating data availability, alert coverage, and investigation readiness.
* Collaborate with security analysts, incident responders, threat hunters, technology owners, and stakeholders across multiple teams and time zones to implement security best practices.
* Provide technical guidance, coaching, and mentoring to junior analysts, fostering a collaborative and learning-focused environment. Role RequirementsEducation
* Preferred: Bachelor's degree in computer science, Information Technology, Engineering, or a related field.
* Minimum education requirement: High school studies completed with Baccalaureate diploma.
* Excellent English communication skills, both verbal and written, for professional communication and documentation. Experience
* Minimum 3 years of experience in cybersecurity operations, including hands-on experience investigating and responding to security incidents across endpoints, network, cloud, and other technology environments.
* Demonstrated experience working in a Security Operations Center, Global Security Operations Center, Managed Security Service, or similar 24/7 operational environment. Mandatory Technical Skills
* Strong understanding of cybersecurity principles, incident response methodologies, structured threat hunting and basic digital forensics.
* Strong knowledge of industry frameworks and best practices, including NIST incident response guidance and structured threat hunting methodologies.
* Hands-on experience with security analytics platforms and query languages to investigate security events, correlate data from multiple sources, and support threat hunting and incident response activities.
* Proficiency with Microsoft Entra ID and security tec