Cyber Security Incident Response Team (CSIRT) Officer

Yechte Consulting Ltd; Brussel; On-site; EUR 70,000 - 100,000; Full time

Job summary

Yechte Consulting Ltd is seeking a seasoned security professional to lead incident response across IT, OT, and IoT environments. You will investigate high‑severity incidents, perform digital forensics, and coordinate with cross-functional teams to mitigate threats.

The role emphasizes threat hunting, SIEM optimization, and development of incident response playbooks. Fluency in English is required; knowledge of French or Dutch is a plus.

Qualifications

• Bachelor's degree in Computer Science, Information Security, or equivalent practical experience.
• At least 4 years of experience in a security-related role with incident response focus.
• Hands-on experience investigating and responding to security incidents including malware infections, intrusions, and data breaches.
• Experience with digital forensics, incident response, security monitoring, and threat intelligence.
• Strong knowledge of security technologies and tools including SIEM, EDR, IDS/IPS, and firewalls.
• Experience with Microsoft Sentinel SIEM, Microsoft Defender, and EDR solutions.
• Ability to read and analyze Windows, Linux, and network logs and artifacts for IOC.
• Experience with threat hunting and investigating suspicious activities across networks and systems.
• Experience with SOC engineering, detection gaps, and automating alert handling.
• Experience with incident response tools like ServiceNow SIR.
• Familiarity with MITRE ATT&CK framework and developing detection rules.

Responsibilities

• Investigate and respond to level 3/4 security incidents including malware infections, intrusions, and data breaches.
• Conduct forensic investigations, coordination, and analysis of security incidents across IT, IoT, or OT.
• Collaborate with SOC, CSIRT, and other teams to identify and mitigate security risks.
• Develop and implement incident response plans and provide guidance on security best practices.
• Communicate incident progress to internal and external stakeholders.
• Proactively identify threats using SIEM and custom detection tools.
• Conduct regular threat hunting to detect hidden threats.
• Analyze logs and artifacts from Windows, Linux, and network sources for signs of compromise.
• Read and understand logs to analyze system artifacts for indicators of compromise.
• Develop, maintain, and optimize SIEM systems and create use cases based on MITRE ATT&CK.
• Write playbooks for SOC to ensure consistent incident response.
• Automate responses to SIEM and EDR events to focus on critical tasks.
• Contribute to rolling out new security products, automation, and SOC improvements.
• Organize tabletop exercises and facilitate them.
• Interact professionally with staff, affiliates, and security providers.

Skills

Incident response

Digital forensics

Threat intelligence

Threat hunting

Tabletop exercises

Scripting/Automation

MITRE ATT&CK

Log analysis

Communication

Stakeholder management

Education

Bachelor's degree in Computer Science or Information Security

Tools

Microsoft Sentinel

Microsoft Defender

EDR solutions

SIEM

IDS/IPS

Firewalls

Job description

Job Responsibilities

• Investigate and respond to level 3/4 security incidents, including malware infections, network intrusions, and data breaches.
• Conduct forensic investigations, coordination, and analysis of security incidents, regardless of IT, IoT, or OT origin.
• Work closely with other members of the SOC, CSIRT, and other teams within the organization to identify and mitigate security risks.
• Develop and implement incident response plans and procedures, and provide guidance to other members of the organization on security best practices.
• Communicate and report security incident progress to required internal and external stakeholders.
• Proactively identify threats and vulnerabilities within the organization’s infrastructure using SIEM and custom detection tools.
• Conduct regular threat hunting exercises to detect potential threats that may have evaded traditional security controls.
• Use various tools and techniques to collect and analyze security data, identify anomalous behavior, and detect potential indicators of compromise.
• Work closely with the third-party SOC team to investigate potential security incidents and provide guidance on threat remediation and mitigation strategies.
• Read and understand logs from Windows, Linux, network systems, and other sources to analyze system artifacts for signs of compromise.
• Develop, maintain, and optimize SIEM systems to ensure timely detection and response to security incidents.
• Create and maintain SIEM use cases and detection rules based on the MITRE ATT&CK framework.
• Write playbooks for the SOC team to ensure consistent and effective incident response.
• Automate responses to SIEM and EDR events as much as possible, enabling the SOC and CSIRT to focus on critical activities.
• Contribute to team projects, including rolling out and maintaining new security products or platforms and automating manual tasks using scripts.
• Organize and facilitate tabletop exercises.
• Interact professionally with internal staff, affiliates, and security service providers in an organization-sensitive manner.

Must Have Skills

• Bachelor’s degree in Computer Science, Information Security, a related field, or equivalent practical experience.
• At least 4 years of experience in a security-related role, with a strong focus on incident response and security analysis.
• Hands-on experience investigating and responding to security incidents, including malware infections, network intrusions, and data breaches.
• Experience with digital forensics, incident response, security monitoring, and threat intelligence.
• Strong knowledge of security technologies and tools, including SIEM, EDR, intrusion detection and prevention systems, and firewalls.
• Experience with Microsoft Sentinel SIEM, Microsoft Defender, and EDR solutions.
• Ability to read and analyze Windows, Linux, and network logs and system artifacts for indicators of compromise.
• Experience with threat hunting and investigating suspicious activities across networks and systems.
• Experience with SOC engineering, identifying detection gaps, and automating alert handling.
• Experience with security incident response tools, including ServiceNow SIR.
• Experience with forensic and/or malware analysis techniques.
• Experience organizing and facilitating tabletop exercises.
• Knowledge of the MITRE ATT&CK framework and ability to develop detection rules and use cases.
• Strong analytical and problem-solving skills, with the ability to respond to incidents in a timely and effective manner.
• Excellent customer focus and ability to handle sensitive organizational situations.
• Fluent spoken and written English, minimum C1 level.

Nice to have

• Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, or GREM.
• Working knowledge of French or Dutch.
• Experience working in complex, multi-stakeholder enterprise environments.
• Knowledge of IT, IoT, and OT security environments.
• Experience with security automation, scripting, and workflow orchestration.
• Experience developing incident response playbooks and improving SOC detection capabilities.
• Experience supporting security projects, including platform rollouts, maintenance, and automation initiatives.
• Familiarity with railway, public transport, or critical infrastructure IT ecosystems.

What’s great in the job? Great team of smart people, in a friendly and open culture No waste of time in enterprise processes, real responsibilities and autonomy Expand your knowledge of various business industries Create content that will help our users on a daily basis Real responsibilities and challenges in a fast evolving company