CSIRT Officer Start Date: January 2025

Duration: 6 months (with extension)

Location: Hybrid – 2 days per week on-site (one fixed day)

Languages: Fluent spoken and written English

Role Overview As a CSIRT Officer , you will join the cybersecurity incident response and monitoring team within the organization’s information security department. You will support daily incident detection, analysis, and response activities, as well as threat hunting and continuous improvement initiatives.

The position involves collaboration with internal IT teams, affiliates, and external security service providers to strengthen the company’s overall cybersecurity posture.

Key Responsibilities Incident Handling and Response

• Investigate and respond to advanced (Level 3/4) security incidents such as malware infections, network intrusions, and data breaches.
• Conduct forensic investigations and coordinate response efforts across IT, IoT, and OT environments.
• Collaborate with SOC and CSIRT colleagues to identify, assess, and mitigate security risks.
• Develop and maintain incident response procedures, ensuring alignment with best practices.
• Communicate and report incident progress to relevant stakeholders.

Threat Detection and Hunting

• Conduct proactive threat hunting to identify anomalies and indicators of compromise.
• Analyze logs and system artifacts (Windows, Linux, network devices, etc.) to uncover potential intrusions.
• Collaborate with external SOC providers on threat remediation and improvement strategies.
• Continuously enhance detection capabilities using SIEM and custom tools.

SIEM Engineering

• Develop, maintain, and optimize SIEM systems to enhance real-time threat detection.
• Create and refine use cases, detection rules, and playbooks (based on frameworks such as MITRE ATT&CK).
• Automate alert handling and event response to improve efficiency.

Project Support

• Contribute to cybersecurity and infrastructure projects, including tool rollouts, automation initiatives, and security improvements.

Evaluation Criteria

• Strong analytical and problem-solving skills for effective incident response.
• Knowledge of security technologies such as SIEM, EDR, IDS/IPS, and firewalls.
• Understanding of networking, operating systems, and critical infrastructure environments.
• Experience with digital forensics, malware analysis, and threat intelligence.
• Familiarity with SOC engineering, detection gap analysis, and cloud security concepts.
• Excellent communication skills, customer-oriented mindset, and organizational awareness.

Requirements

• Bachelor’s degree in Computer Science, Information Security, or related field (or equivalent experience).
• 5–10 years of experience in cybersecurity, incident response, or SOC operations.
• Relevant certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, or GREM are an advantage.
• Fluent in English (spoken and written).
• Willingness to work on-site 2 days per week (one fixed day required).