Senior Incident Response Specialist – Cyber Security

About the role

The Senior Incident Response Specialist is responsible for monitoring, detecting and analysing cybersecurity incidents within the Security Operations Centre. Acting as a Level‑2 responder, they bridge SOC analysts and incident response management to ensure timely containment and recovery.

Key responsibilities

• Perform end‑to‑end incident triage and investigation of security alerts escalated from L1 SOC analysts.
• Support the SIEM platform (Elastic Stack) by fine‑tuning existing rules and suggesting new detections.
• Conduct log analysis and correlation across network, endpoint and cloud data sources.
• Create and maintain incident documentation, reports and lessons learned.
• Execute incident response playbooks during containment and recovery phases.
• Collaborate with IT, network and application teams for remediation and root‑cause analysis.
• Use the MITRE ATT&CK framework to map attacks and improve detection quality.
• Participate in threat‑hunting activities using Elastic Stack and related tools.

Required profile

• Proven experience monitoring alerts and performing investigations of security events.
• Ability to conduct deep‑dive investigations of malware, phishing, insider threats and cloud breaches.

Required skills

• Elastic Stack (SIEM)
• MITRE ATT&CK framework
• Threat hunting
• Log analysis across network, endpoint and cloud environments