Incident Response Analyst

We are hiring an Incident Response Analyst to join the Detection and Response team (SOC/CSIRT) of an international technology company, operating within a global follow-the-sun model. This person will provide continuous detection and response coverage for Western Europe, Africa and the Americas, working closely with incident response analysts based in other locations to ensure around-the-clock protection.

The focus of this role is to support the group's cybersecurity strategy and enable innovative prevention, detection, and remediation capabilities in a cloud-native environment. With adversaries increasingly using AI to accelerate and scale their attacks, speed is the top priority: you will be expected to consistently drive down time-to-detect and time-to-remediate, using AI-powered tooling and automation to detect, contain, and eradicate threats faster than they can spread.

Key responsibilities

• Detect, triage, investigate, and respond to security incidents end-to-end — from detection through containment, eradication, and recovery.
  
• Operate within a follow-the-sun model, coordinating disciplined handovers with analysts in other locations to maintain continuous coverage.
  
• Relentlessly drive down mean time to detect (MTTD) and mean time to respond and remediate (MTTR), treating speed as a primary measure of success.
  
• Design and continuously improve incident response playbooks and runbooks, ensuring appropriate, timely escalation.
  
• Build security automation, orchestration, and SOAR workflows so response is fast and repeatable, keeping manual processes to a minimum.
  
• Develop threat-driven detection and monitoring use cases, tuning alerts to maximise signal and minimise noise, while hunting for advanced threats without neglecting basic-hygiene alerts.
  
• Proactively threat hunt across cloud, endpoint, identity, and network telemetry, mapping adversary activity to frameworks such as MITRE ATT&CK.
  
• Run hands-on malware analysis and digital forensics (DFIR) investigations to establish root cause, scope, and impact.
  
• Detect and respond to AI-specific threats — prompt injection, model abuse, GenAI data leakage, and misuse of AI tools and agents — in close partnership with the AI Security function.
  
• Use AI-powered tooling and automation to accelerate detection, triage, investigation, and remediation, applying sound judgement to validate AI-generated output before acting on it.
  
• Coordinate stakeholders inside and outside the technology organisation throughout the incident lifecycle, providing clear, timely updates to technical teams and senior management.
  
• Lead structured post-incident reviews and blameless post-mortems, turning lessons learned into concrete detection, process, and control improvements.
  
• Consume and operationalise threat intelligence to anticipate adversary behaviour and sharpen detection coverage.
  
• Maintain incident records, timelines, and evidence to a forensically sound, audit-ready standard.
  
• Ensure compliance with regulatory requirements for preventive measures and incident reporting (e.g., DORA, GDPR breach notification), partnering with GRC, Legal, and Privacy as needed.
  
• Measure and report relevant security and response metrics to technology teams and senior management, and continuously improve cybersecurity tools and processes based on lessons learned.
  
• Participate in an on-call rotation and support incident-bridge / war-room coordination during major incidents.
  

Profile and competencies

• Passionate about cybersecurity, excited to master the latest trends in technology and adversary tradecraft.
  
• Thinks like an attacker — self-driven, able to think outside-in, and proactive in uncovering blind spots before they are exploited.
  
• Bias for speed and decisiveness under pressure, understanding that in incident response, minutes matter.
  
• AI fluency central to how you work — actively uses AI-powered tools and automation to detect, investigate, and remediate faster, while validating AI-generated output with sound judgement.
  
• Understands how AI reshapes both the threat landscape (AI-accelerated, automated, adaptive attacks) and defensive capabilities.
  
• Hands-on, but also able to drive stakeholders to deliver and meet objectives.
  
• Comfortable working in a global, follow-the-sun team across regions, cultures, and time zones, with disciplined handovers and asynchronous collaboration.
  
• Stays calm, structured, and clear when communicating during high-pressure incidents, to both technical and senior, non-technical audiences.
  
• Motivated to help build a new detection and response capability and make a difference within an international organisation.
  
• Works effectively with all business functions, influencing cross-functional teams without relying on direct authority.
  
• Able to build and mature a practice where standards and processes may not yet exist, with genuine interest in new technologies and automation tools.
  
• Communicates complex security concepts clearly to both technical and executive audiences.
  

Requirements

• At least 3–5 years of professional experience in information security, with hands-on experience in security monitoring and incident response (SOC, CSIRT, or detection-and-response environments).
  
• Demonstrated expertise in IT fundamentals (systems and networks), security best practices, and modern concepts (cloud, DevSecOps, containerisation, APIs, AI/ML, secure by design).
  
• Hands-on experience with security operations tooling — SIEM, EDR/XDR, SOAR, and cloud-native detection tooling across AWS, Azure, GCP, and Microsoft 365.
  
• Excellent knowledge of advanced persistent threats and adversary tools, techniques, and procedures, with familiarity with frameworks such as MITRE ATT&CK.
  
• Practical experience with digital forensics and/or malware analysis.
  
• Programming and scripting experience in Python or similar, for automation.
  
• Strong AI fluency — demonstrated ability to use AI-powered tools and automation to accelerate detection, investigation, and response, with judgement to validate AI output and awareness of AI-specific threats (prompt injection, model abuse, GenAI data leakage).
  
• Extensive understanding of the current threat landscape affecting the financial industry, particularly fintech.
  
• Understanding of current technology and regulatory trends affecting financial-institution information security programs (e.g., DORA, GDPR).
  
• Excellent written and verbal communication skills in English, and the ability to perform under pressure.
  
• Willingness to participate in an on-call rotation and work outside standard business hours during major incidents.
  
• Degree in computer science or a related field.
  
• Relevant GIAC certifications (e.g., GCIH, GCFA, GCIA, GNFA) or equivalent are an advantage.
  

Additional advantages

• Experience in a follow-the-sun or globally distributed SOC / CSIRT.
  
• Familiarity with AI security frameworks such as the OWASP Top 10 for LLM Applications, NIST AI RMF, or MITRE ATLAS.
  
• Detection engineering / detection-as-code experience.
  
• Threat intelligence and threat-hunting experience.