Security Operations & Incident Response Analyst

Incident Response

• Own and coordinate the end-to-end incident response process: identification, triage, containment, eradication, recovery, and post-incident review (lessons learned).

• Serve as the primary point of contact for security incidents escalated from IT Operations, the Security Engineer, and external sources.

• Maintain and continuously improve incident response playbooks for the most relevant threat scenarios (ransomware, phishing, account compromise, data breach, insider threat, etc.).

• Manage the security incident log and register: track all incidents, document timelines and actions, and produce trend analysis and reporting for the CISO.

• Coordinate with external SOC or MDR providers where applicable: review daily reports, validate alert quality, and manage escalation workflows.

Data Breach Management

• Lead data breach investigations: scope the breach, gather and preserve evidence, assess PII exposure, and coordinate response with Legal, Privacy, and HR.

• Produce breach investigation reports with findings, root cause, and recommendations.

Threat Hunting & Intelligence

• Conduct proactive threat hunting across the environment: develop hypotheses based on threat intelligence, search for indicators of compromise (IoCs), and investigate anomalous behaviour.

• Manage the Threat Intelligence function: track relevant threat actors, TTPs (MITRE ATT&CK), and sector-specific threat campaigns; integrate intelligence into SIEM/XDR detection rules and hunting queries.

• Produce threat intelligence summaries and briefings for the CISO and relevant stakeholders.

Vulnerability Management

• Own the vulnerability management programme: schedule and execute periodic vulnerability scans across infrastructure, endpoints, and cloud environments.

• Analyse scan results, prioritise findings by risk and exploitability, and coordinate remediation with IT Operations within agreed SLAs.

• Track remediation progress, produce vulnerability metrics, and report status to the CISO.

• Validate remediation effectiveness through re-scanning and spot-checks.

Identity & Access Management (IAM)

• Manage periodic access reviews: coordinate with system owners and HR to review and certify user permissions across critical systems, ensuring least privilege is maintained.

• Oversee the Privileged Access Management (PAM) programme: define PAM policies, monitor privileged account usage, and review access rights for administrator-level accounts.

• Investigate and respond to identity-related anomalies and access policy violations.

• 3–5 years in a SOC analyst, incident response, or security operations role, with at least 1–2 years at L3 level is a plus.

• Experience implementing or managing IAM and PAM solutions

• Experience working within international or multinational environments.

• Hands-on experience with incident response engagements (internal or consulting) is strongly valued.

• Relevant certifications: GCIH, GCFE, GCFA, CEH, CompTIA CySA+, or equivalent. OSCP is a plus.

• Strong hands-on experience with SIEM platforms (alert triage, rule writing, query development) and EDR/XDR tools.

• Solid knowledge of the MITRE ATT&CK framework and its application to threat hunting and incident response.

• Experience conducting vulnerability scans using tools such as Tenable Nessus, Qualys, Rapid7, or similar.

• Familiarity with IAM and PAM concepts and platforms (e.g. CyberArk, BeyondTrust, Azure PIM, or equivalent).

• Experience with digital forensics and incident response (DFIR) methodologies: evidence collection, log analysis, and timeline reconstruction.

• Knowledge of threat intelligence platforms and feeds (e.g. MISP, VirusTotal, threat intel feeds).

• Understanding of ISO 27001 incident management controls, NIS2 incident reporting obligations, and PCI DSS requirement 12.10.

• Calm and decisive under pressure.
• Strong investigative mindset with structured problem-solving approach, excellent documentation skills.
• Ability to communicate incident status and findings clearly to both technical teams and executive stakeholders.
• Collaborative and proactive, comfortable working asynchronously across time zones.

• English: full professional proficiency (C1/C2) — primary working language. Spanish: professional proficiency is a plus.