Cyber Security Services Incident Response Engineer
Hace 3 días
España
Stefanini Emea
Jornada completa
Gratis con email o Google
Guarda esta oferta y sigue tu búsqueda
Crea una cuenta gratis para guardar empleos, crear alertas y volver a esta oferta desde tu panel.
Gratis con email o Google
Al continuar, aceptas nuestros Términos & Política de Privacidad.
Stefanini Group is seeking a skilled Cyber Security Services (CSS) Incident Response (IR) Engineer to join our Security Operations Center (SOC), which operates as a Managed Security Service Provider (MSSP).
As a CSS IR Engineer, you will manage security incidents, develop incident response processes, and enhance security configurations tailored to client needs.
Your expertise will be crucial in reducing false positives and identifying security gaps within the client's IT infrastructure.
Work Schedule: Two rotating 8.5-hour shifts within the 7:00 a.
M.-Own assigned security alerts, incidents, and escalated tickets, providing technical guidance and resolving investigation or response issues.
Lead investigations across endpoint, identity, email, network, cloud, and other available telemetry sources.
Analyze endpoint and Microsoft Entra ID activity to identify indicators of compromise, suspicious access, malicious execution, persistence, privilege escalation, lateral movement, and other adversary techniques.
Interpret correlated investigation results from SentinelOne Singularity Data Lake, PowerQuery, Microsoft Entra ID, and other security platforms.
Produce operational reporting covering alert volumes, case status, investigation outcomes, false positives, detection and automation performance, service-level results, tool and log-source health, and MTTR.
Conduct forensic analysis and support structured threat hunting and proactive detection initiatives based on emerging threats, vulnerabilities, TTPs, and observed attack patterns.
Contribute to security improvements by maintaining procedures, playbooks, workflows, investigation guides, and technical documentation, and by recommending improvements to detection, monitoring, and response processes.
Present incident findings and recommendations to security teams and stakeholders; Role
Requirements:
Education:
Preferred: Bachelor's degree in computer science, Information Technology, Engineering, or a related field.
Excellent English communication skills, both verbal and written, for professional communication and documentation.
Experience:
Minimum 5 years of experience in cybersecurity operations, including hands?on experience investigating and responding to security incidents across endpoints, network, cloud, and other technology environments.
Practical experience reviewing, designing, correcting, or improving security automation, SOAR workflows, detection logic, or automated incident?Demonstrated experience working in a Security Operations Center, Global Security Operations Center, Managed Security Service, or similar 24/7 operational environment.
Mandatory Technical
Skills:
Strong understanding of cybersecurity principles, incident response methodologies, structured threat hunting and basic digital forensics.
Strong experience with incident investigation and alert analysis using SIEM, EDR, XDR, NDR, or similar technologies. Proficiency with Microsoft Entra ID.
Have
Qualifications:
Hands?on certifications in incident response, forensics, threat hunting, or malware analysis
- for example GCIH, GCFA, GCDA, GREM, ECIH, CySA+, eCTHP, CDSA, or OSCP. Professional
Skills:
Ability to perform effectively during crises, make sound decisions, recommend effective solutions, and manage competing priorities during security incidents.
Ability to work effectively in a complex global environment involving multiple entities, varying levels of IT maturity, and diverse regulatory requirements.focused mindset dedicated to delivering exceptional service.
Ability to quickly adapt to changes, new requirements, or sudden shifts in direction.
Absolute discretion and integrity in handling sensitive customer information and critical infrastructure data.
About us
We are the Stefanini group, a global tech consulting company of Brazilian origin that believes in the power of people to transform businesses through technology.
Here, we like to say that technology is not the end, but the means: what really matters are the people who drive it all.
We are a company, a group, that breathes collaboration and offers a dynamic environment where you will learn by doing, grow alongside the team, and have space to contribute with ideas and projects.
More than just talking about digital transformation, we believe in real transformation that starts with people and impacts real businesses.
Work Schedule: Two rotating 8.5-hour shifts within the 7:00 a.
M.-Own assigned security alerts, incidents, and escalated tickets, providing technical guidance and resolving investigation or response issues.
Lead investigations across endpoint, identity, email, network, cloud, and other available telemetry sources.
Analyze endpoint and Microsoft Entra ID activity to identify indicators of compromise, suspicious access, malicious execution, persistence, privilege escalation, lateral movement, and other adversary techniques.
Interpret correlated investigation results from SentinelOne Singularity Data Lake, PowerQuery, Microsoft Entra ID, and other security platforms.
Produce operational reporting covering alert volumes, case status, investigation outcomes, false positives, detection and automation performance, service-level results, tool and log-source health, and MTTR.
Conduct forensic analysis and support structured threat hunting and proactive detection initiatives based on emerging threats, vulnerabilities, TTPs, and observed attack patterns.
Contribute to security improvements by maintaining procedures, playbooks, workflows, investigation guides, and technical documentation, and by recommending improvements to detection, monitoring, and response processes.
Present incident findings and recommendations to security teams and stakeholders; Role
Requirements:
Education:
Preferred: Bachelor's degree in computer science, Information Technology, Engineering, or a related field.
Excellent English communication skills, both verbal and written, for professional communication and documentation.
Experience:
Minimum 5 years of experience in cybersecurity operations, including hands?on experience investigating and responding to security incidents across endpoints, network, cloud, and other technology environments.
Practical experience reviewing, designing, correcting, or improving security automation, SOAR workflows, detection logic, or automated incident?Demonstrated experience working in a Security Operations Center, Global Security Operations Center, Managed Security Service, or similar 24/7 operational environment.
Mandatory Technical
Skills:
Strong understanding of cybersecurity principles, incident response methodologies, structured threat hunting and basic digital forensics.
Strong experience with incident investigation and alert analysis using SIEM, EDR, XDR, NDR, or similar technologies. Proficiency with Microsoft Entra ID.
Have
Qualifications:
Hands?on certifications in incident response, forensics, threat hunting, or malware analysis
- for example GCIH, GCFA, GCDA, GREM, ECIH, CySA+, eCTHP, CDSA, or OSCP. Professional
Skills:
Ability to perform effectively during crises, make sound decisions, recommend effective solutions, and manage competing priorities during security incidents.
Ability to work effectively in a complex global environment involving multiple entities, varying levels of IT maturity, and diverse regulatory requirements.focused mindset dedicated to delivering exceptional service.
Ability to quickly adapt to changes, new requirements, or sudden shifts in direction.
Absolute discretion and integrity in handling sensitive customer information and critical infrastructure data.
About us
We are the Stefanini group, a global tech consulting company of Brazilian origin that believes in the power of people to transform businesses through technology.
Here, we like to say that technology is not the end, but the means: what really matters are the people who drive it all.
We are a company, a group, that breathes collaboration and offers a dynamic environment where you will learn by doing, grow alongside the team, and have space to contribute with ideas and projects.
More than just talking about digital transformation, we believe in real transformation that starts with people and impacts real businesses.