Cybersecurity Incident Response Officer – Sentinel & SIEM

Responsibilities

• Investigate and respond to level 3 and 4 security incidents, including network intrusions, malware infections, and data breaches.
• Conduct digital forensic investigations and analyze security artifacts across IT, IoT, and OT environments.
• Perform proactive threat hunting using SIEM and custom tools to identify anomalous behaviors and indicators of compromise.
• Develop and optimize detection rules and use cases based on the MITRE ATT&CK framework.
• Automate security event responses and develop playbooks to streamline operations within the SOC and CSIRT.
• Coordinate with internal stakeholders and external security providers to communicate incident progress and mitigate risks.

Requirements

• You have 4+ years of experience in a security-focused role with a core specialization in incident response and analysis.
• You possess deep expertise in security monitoring using Sentinel SIEM, EDR, and Microsoft Defender.
• You bring hands-on experience with digital forensics, malware analysis, and artifact analysis for Windows and Linux systems.
• You're experienced in SOC Engineering, including use case development and the automation of alert handling.
• You possess working knowledge of the MITRE ATT&CK framework and ServiceNow SIR modules.
• You have experience in the organization and animation of security tabletop exercises.
• You have obtained relevant certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, or GREM.
• You have strong analytical and problem-solving skills with the ability to identify suspicious activities on complex networks.
• You have a Bachelor's degree in Computer Science, Information Security, or equivalent professional experience.
• You are fluent in English (C1) with working knowledge of Dutch or French.