CSIRT Service Lead

Tata Consultancy Services; Brussel Hoofdstad; On-site; EUR 90,000 - 130,000; Full time

Job summary

Tata Consultancy Services Limited in Belgium seeks a CSIRT Service Lead to drive the operational delivery of the Managed CSIRT service and to act as the primary interface between the customer, CSIRT, SOC and technical teams.

You will lead incident response, service leadership and customer engagement, guiding transition to steady-state operations and coordinating major incidents across cross-functional teams in a multilingual environment.

Qualifications

• Experience leading CSIRT, incident response, SOC or security operations in a large enterprise.
• Proven track record of leading cybersecurity operations and major security incidents.
• Strong knowledge of IR, threat hunting, DFIR, SIEM/XDR and security governance.
• Experience with enterprise security tools (SIEM/XDR) and customer-facing engagements.

Responsibilities

• Lead day-to-day Managed CSIRT operations and coordinate the 24x7 delivery organization.
• Lead and coordinate P1/P2 and major cybersecurity incidents.
• Oversee incident investigation, escalation, containment and post-incident follow-up.
• Coordinate Incident Response, Threat Hunting, DFIR and Cyber Security Advisory activities.
• Monitor service performance against SLAs/KPIs and drive improvements.
• Lead customer service reviews and governance meetings.
• Manage operational risks, escalations and improvements.
• Support transition, knowledge transfer and BAU service commencement.
• Maintain CSIRT processes, runbooks and escalation procedures.
• Coordinate with SOC, Security, IAM, Infrastructure and Service Management.

Skills

CSIRT

Incident Response

Customer engagement

Stakeholder management

Cross-functional leadership

Tools

Microsoft Sentinel

Defender XDR

ServiceNow IR

EDR

Job description

• Languages: Fluent French, Dutch and English
• Function: Cybersecurity Operations / Incident Response

Role Overview

The CSIRT Service Lead will lead the operational delivery of the Managed CSIRT service and act as the primary operational interface between the customer, CSIRT, SOC and supporting technical teams.

The role requires a strong cybersecurity professional with proven experience in incident response, service leadership and customer engagement, capable of leading the service from transition and stabilization into steady-state operations.

Key Responsibilities

• Lead day-to-day Managed CSIRT operations and coordinate the 24x7 delivery organization.
• Lead and coordinate P1/P2 and major cybersecurity incidents.
• Oversee incident investigation, escalation, containment coordination and post-incident follow-up.
• Coordinate Incident Response, Threat Hunting, DFIR and Cyber Security Advisory activities.
• Monitor service performance against agreed SLAs/KPIs and drive corrective and improvement actions.
• Lead customer service reviews and operational governance meetings.
• Manage operational risks, dependencies, escalations and service-improvement actions.
• Support transition, knowledge transfer, readiness, stabilization and BAU service commencement.
• Maintain effective CSIRT processes, runbooks, escalation procedures and operational documentation.
• Coordinate with SOC, Security, IAM, Infrastructure, Service Management and other relevant stakeholders.

Required Experience

• Strong experience in CSIRT, Incident Response, SOC or Security Operations within a large enterprise environment.
• Proven experience leading cybersecurity operations and major security incidents.
• Strong knowledge of Incident Response, Threat Hunting, DFIR, SIEM/XDR and security operations governance.
• Experience with Microsoft Sentinel, Microsoft Defender XDR, ServiceNow Security Incident Response, EDR or similar enterprise security technologies is desirable.
• Strong customer-facing, stakeholder-management and communication skills.
• Ability to lead cross-functional technical teams during high-priority incidents.
• Strong analytical, problem-solving and service-management capabilities.

Mandatory Language Requirement

Professional fluency in:

• French
• Dutch

The candidate must be capable of leading customer meetings, technical discussions, major-incident calls and service-governance sessions confidently in all three languages.