Security Incident Handler

About the role

The Security Incident Handler is a core member of the Security Operations Center, responsible for technical escalation during security incidents. You will assess threat scope, business impact, and recommend containment and remediation actions while staying current on the evolving threat landscape.

Key responsibilities

• Perform detailed analysis of security events and incidents, applying advanced IT security and network threat knowledge.
• Contribute to the creation, modification, and continuous improvement of incident management processes.
• Follow up on unresolved tickets, conduct quality checks, and ensure accurate documentation.
• Provide rapid response during crises, identify Indicators of Compromise (IoCs), and develop mitigation/remediation plans.
• Offer on‑call support outside regular hours and mentor junior team members.
• Apply MITRE ATT&CK framework and Cyber Kill Chain methodology to investigations.
• Escalate to specialized support teams as needed and propose alert‑tuning and suppression improvements.

Required profile

• Degree or diploma in Computer Science, Computer Engineering, Cyber Defense, Computer Forensics, MIS or equivalent.
• Relevant certifications such as ISC2, ISACA, CCNA, CCNP, SANS, CompTIA, MCP, MCSE.
• 2‑3 years of experience in IT operations, security operations, infrastructure support, or network management.
• Hands‑on experience with SIEM platforms, network management tools, and ServiceNow.
• Strong troubleshooting and problem‑solving abilities.

Required skills

• SIEM
• Network management
• ServiceNow
• MITRE ATT&CK framework
• Cyber Kill Chain methodology
• Incident analysis
• Alert tuning
• Troubleshooting
• Problem solving