CSIRT -- Security Technician

Job highlights

• 5+ years cybersecurity experience with expertise in incident response, SIEM (Microsoft Sentinel, Splunk), EDR tools, digital forensics, and threat intelligence frameworks
• Detect, analyze, investigate, contain, and recover from cybersecurity incidents; lead incident response activities; perform forensic investigations; conduct threat hunting and develop detection use cases; coordinate with multiple teams and maintain incident documentation

Job Summary

The CSIRT Analyst is responsible for detecting, analyzing, investigating, containing, eradicating, and recovering from cybersecurity incidents affecting the organization's systems, applications, networks, cloud environments, and information assets. The role requires close collaboration with SOC teams, infrastructure teams, application owners, and business stakeholders to minimize business impact and improve the organization's security posture. Responsibilities align with the CSIRT lifecycle, including Preparation, Detection & Analysis, Containment, Eradication & Recovery, and Post-Incident Activities.

Key Responsibilities

Incident Response & Handling

• Monitor, validate, and investigate security incidents escalated from SOC and other sources.
• Perform incident triage, classification, prioritization, and impact assessment.
• Lead technical investigations and coordinate incident response activities.
• Execute containment, eradication, and recovery activities.
• Track incidents through their entire lifecycle until closure.
• Ensure incidents are handled within defined SLAs.

Deep Investigation

• Perform host, network, and log-based forensic investigations.
• Collect, preserve, and analyze digital evidence.
• Identify root causes and attack vectors.
• Document investigation findings for management and audit requirements.

Threat Analysis & Threat Intelligence

• Analyze Indicators of Compromise (IOCs), TTPs, and threat actor activities.
• Correlate threat intelligence from internal and external sources.
• Recommend preventive and detective security controls.
• Conduct proactive threat hunting activities.
• Develop detection use cases and improve monitoring capabilities.

Incident Reporting & Documentation

• Prepare incident reports, executive summaries, and root cause analysis documents.
• Conduct post-incident review meetings.
• Track and report incident trends and response metrics.
• Maintain incident response playbooks and SOPs.

Stakeholder Coordination

• Coordinate with Infrastructure, Network, Application, Cloud, and Business teams during incidents.
• Support crisis management and major incident response activities.
• Provide security recommendations and remediation guidance.

Continuous Improvement

• Participate in tabletop exercises and cyber simulations.
• Enhance incident response procedures and knowledge base.
• Contribute to security awareness and incident response training programs.

Required Technical Skills

• Incident Response & Incident Handling
• SIEM Platforms (Microsoft Sentinel, Splunk.)
• Endpoint Detection & Response (Microsoft Defender, CrowdStrike, FireEye, Cortex XDR)
• Network Security Analysis
• Digital Forensics Fundamentals
• Threat Intelligence Frameworks
• MITRE ATT&CK Framework
• Malware Analysis (basic to intermediate)
• Windows, Linux, and Cloud Security
• Log Analysis and Event Correlation
• Scripting knowledge (PowerShell, Python, Bash) preferred

Required Certifications (Preferred)

• GCIH (GIAC Certified Incident Handler)
• GCFA / GCFE
• CHFI
• CISSP
• Security+
• Microsoft Security Certifications
• CEH

Experience Requirements

CSIRT Analyst

• 5+ years of cybersecurity experience.
• Experience leading major security incidents and deep investigations.
• Experience handling malware, phishing, endpoint compromise, and network-based incidents
• Strong knowledge of threat intelligence, threat hunting, and incident coordination