CSIRT Officer

Context

As a CSIRT Officer, you will join the CISO Cybersecurity Center of Excellence team within the CISO organization of a major European railway company. You will contribute to the daily security incident preparation, detection, and response activities including threat detection, incident handling, threat hunting, as well as propose and execute improvement actions. You will interact with the staff of the organization (including its affiliates) and the security service providers.

Missions

• Investigate and respond to level 3/4 security incidents, including malware infections, network intrusions, and data breaches
• Conduct forensic investigations, coordination, and analysis of security incidents, regardless of IT, IoT, or OT origin
• Work closely with other members of the SOC, CSIRT, and other teams within the organization to identify and mitigate security risks
• Develop and implement incident response plans and procedures, and provide guidance to other members of the organization on security best practices
• Communicate and report security incident progress to required internal and external stakeholders
• Proactively identify threats and vulnerabilities within the organization's infrastructure using SIEM and custom detection tools
• Conduct regular threat hunting exercises to detect potential threats that may have evaded traditional security measures
• Analyze logs (Windows, Linux, network, etc.) to identify anomalous behavior and potential indicators of compromise
• Collaborate with the 3rd party SOC team to investigate potential security incidents and provide guidance on threat remediation and mitigation strategies
• Develop, maintain, and optimize SIEM systems to ensure timely detection and response to security incidents
• Create and maintain use cases and detection rules based on the MITRE ATT&CK framework
• Write playbooks for the SOC team to ensure consistent and effective incident response
• Automate response to SIEM and EDR events to allow SOC and CSIRT teams to focus on critical tasks
• Contribute to various projects such as rolling out new products or platforms, maintaining them, and automating manual tasks with scripts

Tools & Environment

• Security incident response tools including Servicenow SIR module
• Sentinel SIEM
• Endpoint Detection and Response (EDR) tools
• Defender intrusion detection and prevention systems
• Firewalls
• MITRE ATT&CK framework for detection rule development
• Forensic investigation tools and malware analysis techniques

Working Conditions

• Bachelor's degree in Computer Science, Information Security, related field, or equivalent experience
• At least 4 years of experience in a security-related role, focusing on incident response and analysis
• Experience in organizing and facilitating tabletop exercises
• Relevant certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, GREM
• Spoken and written fluency in English (minimum C1 level)
• Contractor is required to be present at the company office up to five days per week for the assignment execution; on-site presence requirements may vary and will be communicated during the assignment
• Knowledge of the company’s IT ecosystem and working knowledge of French or Dutch is a plus

Evaluation Criteria

• Demonstrated strong analytical and problem-solving skills with timely and effective security incident response
• Experience with security incident response tools and techniques, including forensics and malware analysis
• Strong knowledge of security technologies and tools
• Experience with threat hunting and investigation of suspicious network and system activities
• Experience with SOC engineering, detection capability gap identification, and alert handling automation
• Demonstrable expertise in security monitoring, digital forensics, incident response, and threat intelligence
• Customer-focused and able to handle sensitive organizational contexts appropriately

1. Bachelor's degree in Computer Science, Information Security, related field or equivalent experience
2. At least 4 years of experience in a security-related role, with a focus on incident response and analysis
3. Experienced in tabletops organisation and animation
4. Relevant certifications, such as the GCIH, GCFE, GCFA, GNFA, GCIA, GREM
5. Spoken and written fluency in English (min. C1 level)
6. Strong analytical and problem-solving skills, with the ability to identify and respond to security incidents in a timely and effective manner
7. Experience with security incident response tools (Servicenow SIR module) and techniques, including forensics and/or malware analysis
8. Strong knowledge of security technologies and tools, such as Sentinel SIEM, EDR, Defender intrusion detection and prevention, firewalls
9. Experience with threat hunting and the ability to identify and investigate suspicious activities on the network and systems
10. Experience with SOC Engineering and identifying gaps in detection capabilities, as well as the ability to automate alert handling
11. Demonstrable knowledge, experience and/or professional expertise in security monitoring, digital forensics, incident response, and threat intelligence
12. Customer focus and able to handle in an organization-sensitive way
13. Knowledge of SNCB IT ecosystem
14. Working knowledge of French (FR) or Dutch (NL)