Cyber Security Incident Response Team (CSIRT) Officer

About the mandate

For a large organisation with an extensive IT, IoT and OT environment in Brussels, we are looking for an experienced CSIRT Officer. You will be part of the Cybersecurity Center of Excellence within the CISO organisation and play a key role in detecting, investigating and countering cyber threats. You handle complex incidents, carry out forensic investigations and continuously strengthen detection and response. You work closely with internal security teams, external SOC partners and various IT, IoT and OT stakeholders. Besides incident handling, you proactively hunt for hidden threats, work on SIEM detection rules and automate security processes. Depending on project needs, you will come to the office up to 5 days a week.

Responsibilities

• Investigating and handling complex Level 3/4 security incidents, such as malware infections, network intrusions and data breaches
• Carrying out digital forensic investigations and root cause analyses
• Coordinating incident response in IT, IoT and OT environments
• Proactively performing threat hunting and analysing security logs, system artefacts and Indicators of Compromise
• Developing and maintaining SIEM detection rules and use cases according to the MITRE ATT&CK framework
• Optimising SIEM and EDR solutions and automating monitoring, alert handling and incident response
• Drafting and improving incident response plans, procedures and playbooks, and organising tabletop exercises
• Reporting to stakeholders, advising on security best practices and contributing to security projects and new tools

Must-haves

• At least 4 years of relevant experience in cybersecurity, with a focus on incident response and security analysis
• Bachelor's degree in Computer Science, Information Security or a related field, or equivalent through experience
• Experience with complex Level 3/4 incidents, digital forensic analysis and threat hunting
• Strong knowledge of Microsoft Sentinel, Microsoft Defender and EDR
• Experience with ServiceNow Security Incident Response
• Thorough knowledge of the MITRE ATT&CK framework and analysis of Windows, Linux and network logs
• Experience with scripting for security automation and with organising tabletop exercises
• Fluent English (at least C1), professional working knowledge of Dutch or French is desirable

Nice-to-haves

• Security certifications such as GCIH, GCFE, GCFA, GNFA, GCIA or GREM
• Expertise in SIEM Engineering, detection optimisation and security automation
• Experience with IoT and OT environments
• Knowledge of IT environments in the railway sector
• Experience working with external SOC service providers

What the employer offers

• A key role within the Cybersecurity Center of Excellence of the CISO organisation
• Working in a large-scale enterprise environment with IT, IoT and OT infrastructures
• Close collaboration with the CISO, SOC, CSIRT, IT teams and external security partners
• Involvement in cybersecurity projects and the introduction of new security tools