Cyber SOC Incident Response Specialist

About the role

Join Nestlé’s Regional Service Centre as a Cyber SOC Incident Response Specialist, leading investigations and response to sophisticated cyber‑attacks across a global enterprise environment. You will protect critical digital assets, drive threat‑hunting initiatives and ensure continuous security improvements in collaboration with global security and business teams.

Key responsibilities

• Lead end‑to‑end technical investigations across endpoint, identity, email, network, public‑cloud and SaaS environments, reconstructing full attack chains.
• Perform deep‑dive analysis using SIEM, EDR/XDR telemetry, cloud audit logs, identity sign‑in logs and network flow data to determine scope, root cause and attacker objectives.
• Drive containment, eradication and recovery actions such as credential rotation, session revocation, policy hardening and host isolation while coordinating with Security Engineering, Legal and Privacy teams.
• Act as Incident Commander for major incidents, run the bridge, provide 30‑minute cadence updates and make evidence‑based decisions across global time zones.
• Mentor L1/L2 analysts, participate in on‑call rotation and represent the CSIRT in cross‑functional and purple‑team exercises.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science, Information Security or a related field.
• 6–8 years of experience in security operations, incident response or digital forensics at an enterprise scale.
• Proven track record managing full‑life‑cycle cyber incidents and delivering executive‑level briefings.
• Relevant certifications such as CISSP, GCIH, GCFA, GCFE or cloud‑security credentials are preferred.
• Business‑level proficiency in Mandarin is an advantage.

Required skills

• Hands‑on experience with SIEM platforms, EDR/XDR solutions and cloud‑security tools.
• Proficiency in security query languages and scripting: KQL, SPL, SQL, Python, PowerShell.
• Deep knowledge of MITRE ATT&CK framework, threat‑intelligence platforms and forensic evidence collection (memory capture, disk imaging, registry hives).
• Expertise in investigating endpoint, network, email, identity and cloud security incidents.