Cyber Security Incident Response Team (CSIRT) Officer

Mindwave; Brussel Hoofdstad; Hybrid; EUR 75,000 - 110,000; Full time

Benefits offered by this job

Medical insurance

Meal vouchers

Remote-work allowance

Training budget

Job summary

MindWave is seeking a Cyber Security Incident Response Team (CSIRT) Officer to join our Corporate CSIRT Center of Excellence in Brussels. You will lead level 3/4 incident response, conduct forensic analysis, threat hunting, and SIEM engineering tasks while coordinating with internal teams and external providers.

Responsibilities include investigating incidents across IT/OT environments, developing incident playbooks, and communicating findings to stakeholders.

Qualifications

• Bachelor's degree in Computer Science, Information Security, a related field, or equivalent professional experience.
• Minimum 4 years of professional experience in a security-related role, with a strong focus on incident response and technical security analysis.
• Demonstrated experience in organizing, planning, and animating tabletop exercises.
• Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, GREM, or equivalent.
• Fluent in English (C1); working knowledge of Dutch or French is an asset.

Responsibilities

• Investigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments.
• Conduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin.
• Work closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks.
• Develop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization.
• Clearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders.

Skills

Incident response

Forensics

Threat hunting

MITRE ATT&CK mapping

Communication

Education

Bachelor's degree in Computer Science / Information Security

Tools

Microsoft Sentinel

EDR

Microsoft Defender

IDS/IPS

Firewalls

ServiceNow SIR

Job description

At MindWave, we’re not just building teams. We’re building a new way of working. We’re creating a community of experts who thrive in a transparent, human, and forward-thinking environment.

We are currently looking for a Cyber Security Incident Response Team (CSIRT) Officer to join our community and support a major CISO Cybersecurity Center of Excellence team. In this role, you will contribute to daily security incident preparation, detection, and response activities—including threat detection, level 3/4 incident handling, forensic analysis, threat hunting, and SIEM engineering—while working closely with internal staff, affiliates, and external security service providers.

Key Responsibilities

• Investigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments.
• Conduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin.
• Work closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks.
• Develop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization.
• Clearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders.

1. Incident Handling & Level 3/4 Response

• Investigate and respond adequately to Level 3/4 security incidents, including malware infections, network intrusions, and data breaches across IT, IoT, and OT environments.
• Conduct forensic investigations, technical coordination, and deep-dive analysis of security incidents regardless of origin.
• Work closely with SOC, CSIRT, and cross-functional internal teams to identify, mitigate, and remediate security risks.
• Develop, refine, and implement incident response plans and procedures, providing guidance on security best practices across the organization.
• Clearly communicate and report security incident progress, risks, and post-incident analysis to internal and external stakeholders.

2. Threat Detection & Threat Hunting

• Proactively identify threats and vulnerabilities across the organization's infrastructure using SIEM platforms and custom detection tools.
• Conduct regular threat hunting exercises to detect potential threats that have evaded traditional security controls.
• Collect and analyze security data and system artifacts (analyzing Windows, Linux, network, and security logs) to identify anomalous behavior and indicators of compromise (IOCs).
• Collaborate closely with the 3rd party SOC team to investigate potential security incidents and provide technical guidance on threat remediation and mitigation strategies.

3. SIEM Engineering & Automation

• Develop, maintain, and optimize SIEM systems (e.g., Microsoft Sentinel) to ensure timely detection and rapid incident response.
• Create, refine, and maintain custom detection rules and use cases aligned with the MITRE ATT&CK framework.
• Author and maintain detailed playbooks for the SOC team to ensure standardized, consistent, and effective incident response.
• Automate alert handling and response workflows for SIEM and EDR events to streamline security operations and allow the SOC/CSIRT to focus on high-priority threats.

4. Projects, Exercises & Continuous Improvement

• Organize, animate, and facilitate cybersecurity tabletop exercises to test organizational incident response readiness.
• Contribute to security engineering projects based on team needs, such as deploying, maintaining, and integrating new security platforms or tools.
• Script and automate manual operational tasks to enhance the team's efficiency and detection capabilities.

Team Context

You will join the CISO Cybersecurity Center of Excellence team within the enterprise CISO organization. You will collaborate closely with fellow CSIRT officers, internal IT/OT/IoT teams, the 3rd party Security Operations Center (SOC) team, organizational affiliates, and external security service providers.

Conformity & Qualification Criteria

• Education: Bachelor's degree in Computer Science, Information Security, a related field, or equivalent professional experience.
• Experience: Minimum 4 years of professional experience in a security-related role, with a strong focus on incident response and technical security analysis.
• Tabletop Exercises: Demonstrated experience in organizing, planning, and animating tabletop exercises.
• Certifications: Relevant industry certifications such as GCIH, GCFE, GCFA, GNFA, GCIA, GREM, or equivalent.
• Language Proficiency: Spoken and written fluency in English (minimum C1 level). Working knowledge of Dutch (NL) or French (FR) is an asset.
• Location & Presence: Hybrid setup with presence at the client office in Brussels
  

Key Technical Competencies & Evaluation Assets

• Strong analytical and problem-solving skills with the ability to identify and respond to security incidents in a timely, calm, and effective manner.
• Hands-on experience with Incident Response tools and platforms (e.g., ServiceNow SIR module), forensics frameworks, and malware analysis.
• Strong technical expertise in security technologies and ecosystem tools, such as Microsoft Sentinel SIEM, EDR solutions, Microsoft Defender suite, intrusion detection/prevention systems (IDS/IPS), and firewalls.
• Practical experience in SOC/SIEM engineering, identifying gaps in detection coverage, writing MITRE ATT&CK-mapped use cases, and building automated playbooks.
• Proven knowledge in security monitoring, digital forensics, threat intelligence, and log analysis (Windows, Linux, network devices).
• Customer-focused mindset with the ability to handle security incidents in an organization-sensitive and diplomatic manner.
• Working knowledge of French (FR) or Dutch (NL).
  

Soft Skills and MindWave Mindset

At MindWave, we value people who are not only strong in what they do, but also in how they work with others.

• Autonomy & Ownership: You take full ownership of security incidents and feel comfortable working with high autonomy. You stay calm under pressure, explore technical anomalies methodically, and turn analysis into concrete action plans.
• Pragmatism & Open Communication: You combine technical thoroughness with a pragmatic approach to risk. You communicate openly when you identify security gaps, risks, or opportunities for automation.
• Curiosity & Knowledge Sharing: Cybersecurity moves fast. You are naturally curious, eager to experiment with new threat hunting techniques or detection frameworks, and passionate about sharing knowledge with your peers.
• Transparency & Trust: You value transparency, trust, and clear communication—especially during critical security incidents when clarity and human connection matter most.

Why Join MindWave?

• Community of Experts: Natural and planned knowledge-sharing moments, such as brown bag sessions on AI, cybersecurity innovations, and emerging tech.
• Flexible Setup: Balanced hybrid setup aligning client operational requirements with remote flexibility and strong community support.
• Transparent & Human Culture: A transparent working environment where you can grow, contribute, and be yourself.
• Accessible Leadership: Direct interaction and genuine involvement from leadership in the lives of our consultants and community.
• High-Impact Project: A long-term, technically challenging mission protecting critical enterprise infrastructure.
• Competitive Package: Complete package for employees (medical insurance, meal vouchers, training budget, remote-work allowance) and full transparency on rates and fees for freelancers.